Weaknesses of type CWE-74

4,802 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-13171MEDIUMZZCMS wangkan_list.php sql injectionEPSS 0.4%CVE-2025-15205MEDIUMcode-projects Student File Management System download.php sql injectionEPSS 0.4%CVE-2025-13263MEDIUMSourceCodester Online Magazine Management System categories.php sql injectionEPSS 0.4%CVE-2025-14203MEDIUMcode-projects Question Paper Generator selectquestionuser.php sql injectionEPSS 0.4%CVE-2025-13278MEDIUMprojectworlds Advanced Library Management System borrowed_book_search.php sql injectionEPSS 0.4%CVE-2024-35777LOWWordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerabilityEPSS 0.4%CVE-2025-13256MEDIUMprojectworlds Advanced Library Management System borrow.php sql injectionEPSS 0.4%CVE-2025-13253MEDIUMprojectworlds Advanced Library Management System add_librarian.php sql injectionEPSS 0.4%CVE-2025-13264MEDIUMSourceCodester Online Magazine Management System view_magazine.php sql injectionEPSS 0.4%CVE-2025-13243MEDIUMcode-projects Student Information System editprofile.php sql injectionEPSS 0.4%CVE-2025-14193MEDIUMcode-projects Employee Profile Management System view_personnel.php sql injectionEPSS 0.4%CVE-2025-13251MEDIUMWeiYe-Jing datax-web sql injectionEPSS 0.4%CVE-2025-14229MEDIUMSourceCodester Inventory Management System SVC Report Export csv injectionEPSS 0.4%CVE-2025-14589MEDIUMcode-projects Prison Management System search.php sql injectionEPSS 0.4%CVE-2025-13254MEDIUMprojectworlds Advanced Library Management System add_member.php sql injectionEPSS 0.4%CVE-2025-11402MEDIUMSourceCodester Hotel and Lodge Management System del_curr.php sql injectionEPSS 0.4%CVE-2026-4568MEDIUMSourceCodester Sales and Inventory System HTTP GET Request update_supplier.php sql injectionEPSS 0.4%CVE-2025-11487MEDIUMSourceCodester Farm Management System uploadProduct.php sql injectionEPSS 0.4%CVE-2025-11401MEDIUMSourceCodester Hotel and Lodge Management System save_curr.php sql injectionEPSS 0.4%CVE-2025-11469MEDIUMSourceCodester Hotel and Lodge Management System save_customer.php sql injectionEPSS 0.4%