Weaknesses of type CWE-74

4,802 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-13210MEDIUMitsourcecode Inventory Management System index.php sql injectionEPSS 0.3%CVE-2025-8247MEDIUMProjectworlds Online Admission System admin.php sql injectionEPSS 0.3%CVE-2025-62697HIGHImproperly sanitized style parameter in LanguageSelectorEPSS 0.3%CVE-2026-2018MEDIUMitsourcecode School Management System controller.php sql injectionEPSS 0.3%CVE-2026-2012MEDIUMitsourcecode Student Management System index.php sql injectionEPSS 0.3%CVE-2026-2136MEDIUMprojectworlds Online Food Ordering System view-ticket.php sql injectionEPSS 0.3%CVE-2026-3616MEDIUMDefaultFuction Jeson Customer Relationship Management System edit.php sql injectionEPSS 0.3%CVE-2026-39419LOWMaxKB: Sandbox Result Validation Bypass via Tool Output SpoofingEPSS 0.3%CVE-2026-2057MEDIUMSourceCodester Medical Center Portal Management System login.php sql injectionEPSS 0.3%CVE-2026-9568LOWThingsBoard YAML provision getGatewayDockerComposeFile code injectionEPSS 0.3%CVE-2026-2011MEDIUMitsourcecode Student Management System controller.php sql injectionEPSS 0.3%CVE-2026-2060MEDIUMcode-projects Simple Blood Donor Management System editcampaignform.php sql injectionEPSS 0.3%CVE-2024-39320MEDIUMDiscourse allows iframe injection though default site settingEPSS 0.3%CVE-2025-11071MEDIUMSeaCMS Cron Task Management admin_cron.php sql injectionEPSS 0.3%CVE-2026-2195MEDIUMcode-projects Online Reviewer System questions-view.php sql injectionEPSS 0.3%CVE-2026-2197MEDIUMcode-projects Online Reviewer System exam-delete.php sql injectionEPSS 0.3%CVE-2026-2115MEDIUMitsourcecode Society Management System delete_expenses.php sql injectionEPSS 0.3%CVE-2026-2211MEDIUMcode-projects Online Music Site AdminDeleteCategory.php sql injectionEPSS 0.3%CVE-2026-2212MEDIUMcode-projects Online Music Site AdminEditCategory.php sql injectionEPSS 0.3%CVE-2026-2199MEDIUMcode-projects Online Reviewer System user-delete.php sql injectionEPSS 0.3%