Weaknesses of type CWE-74

4,808 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-10409MEDIUMSourceCodester Student Grading System rms.php sql injectionEPSS 0.3%CVE-2025-11611MEDIUMSourceCodester Simple Inventory System user.php sql injectionEPSS 0.3%CVE-2025-7588MEDIUMPHPGurukul Dairy Farm Shop Management System edit-product.php sql injectionEPSS 0.3%CVE-2025-10602MEDIUMSourceCodester Online Exam Form Submission delete_s1.php sql injectionEPSS 0.3%CVE-2025-11612MEDIUMcode-projects Simple Food Ordering System addproduct.php sql injectionEPSS 0.3%CVE-2025-12853MEDIUMSourceCodester Best House Rental Management System admin_class.php delete_house sql injectionEPSS 0.3%CVE-2025-11478MEDIUMSourceCodester Farm Management System myCart.php sql injectionEPSS 0.3%CVE-2025-12262MEDIUMcode-projects Online Event Judging System edit_criteria.php sql injectionEPSS 0.3%CVE-2025-12873MEDIUMCampcodes School File Management update_user.php sql injectionEPSS 0.3%CVE-2025-10613MEDIUMitsourcecode Student Information System leveledit1.php sql injectionEPSS 0.3%CVE-2025-10780MEDIUMCodeAstro Simple Pharmacy Management view.php sql injectionEPSS 0.3%CVE-2025-11041MEDIUMitsourcecode Open Source Job Portal index.php sql injectionEPSS 0.3%CVE-2025-11104MEDIUMCodeAstro Electricity Billing System bill.php sql injectionEPSS 0.3%CVE-2025-11590MEDIUMCodeAstro Gym Management System equipment-entry.php sql injectionEPSS 0.3%CVE-2025-11593MEDIUMCodeAstro Gym Management System delete-equipment.php sql injectionEPSS 0.3%CVE-2025-7591MEDIUMPHPGurukul Dairy Farm Shop Management System view-invoice.php sql injectionEPSS 0.3%CVE-2025-10625MEDIUMSourceCodester Online Exam Form Submission dashboard.php sql injectionEPSS 0.3%CVE-2025-7585MEDIUMPHPGurukul Online Fire Reporting System manage-site.php sql injectionEPSS 0.3%CVE-2026-30874LOWOpenWrt procd PATH Environment Variable Filter Bypass via Incorrect String Comparison Leads to Privilege EscalationEPSS 0.3%CVE-2026-44458MEDIUMHono: CSS Declaration Injection via Style Object Values in JSX SSREPSS 0.3%