Weaknesses of type CWE-74

4,802 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-9840MEDIUMitsourcecode Sports Management System gametype.php sql injectionEPSS 0.4%CVE-2018-25106MEDIUMwebuidesigning NebulaX Theme Legacy.php nebula_send_to_hubspot sql injectionEPSS 0.4%CVE-2026-55374MEDIUMcanto-saas-api: Authenticated API requests can be redirected via unencoded path variablesEPSS 0.4%CVE-2025-5783MEDIUMPHPGurukul Employee Record Management System editmyexp.php sql injectionEPSS 0.4%CVE-2026-81526HIGHCross-database write redirection via unvalidated dotted database name in bulk write namespacesEPSS 0.4%CVE-2026-0701MEDIUMcode-projects Intern Membership Management System add_admin.php sql injectionEPSS 0.4%CVE-2026-1118MEDIUMitsourcecode Society Management System add_activity.php sql injectionEPSS 0.4%CVE-2026-0697MEDIUMcode-projects Intern Membership Management System edit_admin.php sql injectionEPSS 0.4%CVE-2026-0699MEDIUMcode-projects Intern Membership Management System edit_activity.php sql injectionEPSS 0.4%CVE-2025-4213MEDIUMPHPGurukul Online Birth Certificate System search.php sql injectionEPSS 0.4%CVE-2025-4152MEDIUMPHPGurukul Online Birth Certificate System bwdates-reports-details.php sql injectionEPSS 0.4%CVE-2025-1691HIGHMongoDB Shell may be susceptible to Control Character Injection via autocompleteEPSS 0.4%CVE-2025-9412MEDIUMlostvip-com ruoyi-go DictDataDao.go SelectListByPage sql injectionEPSS 0.4%CVE-2025-9410MEDIUMlostvip-com ruoyi-go GenTableDao.go SelectListByPage sql injectionEPSS 0.4%CVE-2024-37442LOWWordPress Photo Gallery by Ays – Responsive Image Gallery plugin < 5.7.1 - HTML Injection vulnerabilityEPSS 0.4%CVE-2026-0850MEDIUMcode-projects Intern Membership Management System delete_activity.php sql injectionEPSS 0.4%CVE-2025-9411MEDIUMlostvip-com ruoyi-go LoginInforService.go SelectPageList sql injectionEPSS 0.4%CVE-2025-13279MEDIUMcode-projects Nero Social Networking Site profilefriends.php sql injectionEPSS 0.4%CVE-2025-14589MEDIUMcode-projects Prison Management System search.php sql injectionEPSS 0.4%CVE-2025-14834MEDIUMcode-projects Simple Stock System checkuser.php sql injectionEPSS 0.4%