Weaknesses of type CWE-74

4,806 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-7559MEDIUMPHPGurukul Online Fire Reporting System bwdates-report-result.php sql injectionEPSS 0.3%CVE-2025-7561MEDIUMPHPGurukul Online Fire Reporting System team-ontheway-requests.php sql injectionEPSS 0.3%CVE-2025-7584MEDIUMPHPGurukul Online Fire Reporting System add-team.php sql injectionEPSS 0.3%CVE-2025-7557MEDIUMcode-projects Voting System voters_row.php sql injectionEPSS 0.3%CVE-2026-2162MEDIUMitsourcecode News Portal Project aboutus.php sql injectionEPSS 0.3%CVE-2025-12609MEDIUMCodeAstro Gym Management System update-progress.php sql injectionEPSS 0.3%CVE-2023-44109—Clone vulnerability in the huks ta module.Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.3%CVE-2025-9606MEDIUMPortabilis i-Educar agenda_preferencias.php sql injectionEPSS 0.3%CVE-2025-9399MEDIUMYiFang CMS L_tool.php sql injectionEPSS 0.3%CVE-2025-14090MEDIUMAMTT Hotel Broadband Operation System cardmake_down.php sql injectionEPSS 0.3%CVE-2025-46814LOWFastAPI Guard Remote Header Injection via X-Forwarded-For ManipulationEPSS 0.3%CVE-2025-8806MEDIUMzhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 treeData sql injectionEPSS 0.3%CVE-2025-11330MEDIUMPHPGurukul Beauty Parlour Management System sales-reports-detail.php sql injectionEPSS 0.3%CVE-2025-11090MEDIUMitsourcecode Open Source Job Portal index.php sql injectionEPSS 0.3%CVE-2025-10613MEDIUMitsourcecode Student Information System leveledit1.php sql injectionEPSS 0.3%CVE-2025-10625MEDIUMSourceCodester Online Exam Form Submission dashboard.php sql injectionEPSS 0.3%CVE-2025-10780MEDIUMCodeAstro Simple Pharmacy Management view.php sql injectionEPSS 0.3%CVE-2025-11588MEDIUMCodeAstro Gym Management System index.php sql injectionEPSS 0.3%CVE-2025-10626MEDIUMSourceCodester Online Exam Form Submission update_s3.php sql injectionEPSS 0.3%CVE-2025-10409MEDIUMSourceCodester Student Grading System rms.php sql injectionEPSS 0.3%