Weaknesses of type CWE-74

4,802 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-4568MEDIUMSourceCodester Sales and Inventory System HTTP GET Request update_supplier.php sql injectionEPSS 0.4%CVE-2025-11487MEDIUMSourceCodester Farm Management System uploadProduct.php sql injectionEPSS 0.4%CVE-2025-11399MEDIUMSourceCodester Hotel and Lodge Management System save_room.php sql injectionEPSS 0.4%CVE-2025-11403MEDIUMSourceCodester Hotel and Lodge Management System del_booking.php sql injectionEPSS 0.4%CVE-2025-11469MEDIUMSourceCodester Hotel and Lodge Management System save_customer.php sql injectionEPSS 0.4%CVE-2025-11401MEDIUMSourceCodester Hotel and Lodge Management System save_curr.php sql injectionEPSS 0.4%CVE-2025-11486MEDIUMSourceCodester Farm Management System buyNow.php sql injectionEPSS 0.4%CVE-2026-4550MEDIUMcode-projects Simple Gym Management System func.php sql injectionEPSS 0.3%CVE-2026-19787MEDIUMSourceCodester Air Cargo Management System Master.php save_cargo_type sql injectionEPSS 0.3%CVE-2026-85643MEDIUMcode-projects Online Shopping System adduser.php mysqli_query sql injectionEPSS 0.3%CVE-2025-7511MEDIUMcode-projects Chat System update_account.php sql injectionEPSS 0.3%CVE-2025-11088MEDIUMitsourcecode Open Source Job Portal index.php sql injectionEPSS 0.3%CVE-2025-8254MEDIUMCampcodes Courier Management System view_parcel.php sql injectionEPSS 0.3%CVE-2026-92221MEDIUMgedelumbung HospitalManagement app_global_admin_model.php generate_index_pasien sql injectionEPSS 0.3%CVE-2026-86667MEDIUMaircheng-org iWebShop-5 member.php member_list sql injectionEPSS 0.3%CVE-2026-3957MEDIUMxierongwkhd weimai-wetapp Endpoint HomeController.java getLikeMovieList sql injectionEPSS 0.3%CVE-2026-19925MEDIUMSourceCodester Stock Management System Master.php delete_supplier sql injectionEPSS 0.3%CVE-2026-13569MEDIUMweng-xianhu EyouCMS API index.php sql injectionEPSS 0.3%CVE-2026-13495MEDIUMitsourcecode Hospital Management System adminprofile.php sql injectionEPSS 0.3%CVE-2025-5388MEDIUMJeeWMS generateController.do dogenerate sql injectionEPSS 0.3%