Weaknesses of type CWE-74

4,802 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-2132MEDIUMcode-projects Online Music Site AdminUpdateCategory.php sql injectionEPSS 0.3%CVE-2026-2197MEDIUMcode-projects Online Reviewer System exam-delete.php sql injectionEPSS 0.3%CVE-2026-2217MEDIUMitsourcecode Event Management System manage_user.php sql injectionEPSS 0.3%CVE-2026-2073MEDIUMitsourcecode School Management System index.php sql injectionEPSS 0.3%CVE-2026-2083MEDIUMcode-projects Social Networking Site delete_post.php sql injectionEPSS 0.3%CVE-2026-2117MEDIUMitsourcecode Society Management System edit_activity.php sql injectionEPSS 0.3%CVE-2025-9025MEDIUMcode-projects Simple Cafe Ordering System portal.php sql injectionEPSS 0.3%CVE-2025-10105MEDIUMyanyutao0402 ChanCMS search sql injectionEPSS 0.3%CVE-2025-20216MEDIUMCisco Catalyst SD-WAN Manager Reflected HTML Injection VulnerabilityEPSS 0.3%CVE-2026-19785MEDIUMfrancoisjacquet RosarioSIS Student Medical Medical.inc.php sql injectionEPSS 0.3%CVE-2023-4843MEDIUMPega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field utilized in Visual Business Director, however EPSS 0.3%CVE-2025-7102MEDIUMBoyunCMS Server.php sql injectionEPSS 0.3%CVE-2026-82424MEDIUMPHPGurukul Student Information System student_edit1.php sql injectionEPSS 0.3%CVE-2025-8705MEDIUMWanzhou WOES Intelligent Optimization Energy Saving System Energy Overview Module GetTargetConfig sql injectionEPSS 0.3%CVE-2025-9689MEDIUMSourceCodester Advanced School Management System item_select sql injectionEPSS 0.3%CVE-2025-8701MEDIUMWanzhou WOES Intelligent Optimization Energy Saving System GetPageList sql injectionEPSS 0.3%CVE-2025-8702MEDIUMWanzhou WOES Intelligent Optimization Energy Saving System Historical Data Query Module GetVariableByOneIDNew sql injectionEPSS 0.3%CVE-2025-8704MEDIUMWanzhou WOES Intelligent Optimization Energy Saving System Analysis Conclusion Query Module GetAlarmResultProcessList sql injectionEPSS 0.3%CVE-2025-0214LOWTMD Custom Header Menu index.php sql injectionEPSS 0.3%CVE-2025-10110MEDIUMChanCMS search sql injectionEPSS 0.3%