Weaknesses of type CWE-74

4,804 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-8702MEDIUMWanzhou WOES Intelligent Optimization Energy Saving System Historical Data Query Module GetVariableByOneIDNew sql injectionEPSS 0.3%CVE-2025-8706MEDIUMWanzhou WOES Intelligent Optimization Energy Saving System Energy Overview Module CreateFunctionLog sql injectionEPSS 0.3%CVE-2025-8276MEDIUMHTML Injection in Patika Global Technologies' HumanSuiteEPSS 0.3%CVE-2025-13123MEDIUMAMTT Hotel Broadband Operation System get_firstdate.php sql injectionEPSS 0.3%CVE-2025-11038MEDIUMitsourcecode Online Clinic Management System details.php sql injectionEPSS 0.3%CVE-2025-14227MEDIUMPhilipinho Simple-PHP-Blog edit.php sql injectionEPSS 0.3%CVE-2025-8908MEDIUMShanghai Lingdang Information Technology Lingdang CRM event.php sql injectionEPSS 0.3%CVE-2025-7559MEDIUMPHPGurukul Online Fire Reporting System bwdates-report-result.php sql injectionEPSS 0.3%CVE-2025-1836MEDIUMIncorta Edit Insight csv injectionEPSS 0.3%CVE-2025-7563MEDIUMPHPGurukul Online Fire Reporting System completed-requests.php sql injectionEPSS 0.3%CVE-2025-7583MEDIUMPHPGurukul Online Fire Reporting System all-requests.php sql injectionEPSS 0.3%CVE-2025-7558MEDIUMcode-projects Voting System positions_add.php sql injectionEPSS 0.3%CVE-2025-7580MEDIUMcode-projects Voting System positions_row.php sql injectionEPSS 0.3%CVE-2025-7584MEDIUMPHPGurukul Online Fire Reporting System add-team.php sql injectionEPSS 0.3%CVE-2025-7555MEDIUMcode-projects Voting System voters_add.php sql injectionEPSS 0.3%CVE-2025-7582MEDIUMPHPGurukul Online Fire Reporting System assigned-requests.php sql injectionEPSS 0.3%CVE-2025-7581MEDIUMcode-projects Voting System positions_edit.php sql injectionEPSS 0.3%CVE-2025-7562MEDIUMPHPGurukul Online Fire Reporting System new-requests.php sql injectionEPSS 0.3%CVE-2025-7557MEDIUMcode-projects Voting System voters_row.php sql injectionEPSS 0.3%CVE-2025-7556MEDIUMcode-projects Voting System voters_edit.php sql injectionEPSS 0.3%