Weaknesses of type CWE-74

4,811 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-10594MEDIUMSourceCodester Online Student File Management System delete_student.php sql injectionEPSS 0.3%CVE-2025-11591MEDIUMCodeAstro Gym Management System delete-member.php sql injectionEPSS 0.3%CVE-2025-12263MEDIUMcode-projects Online Event Judging System edit_judge.php sql injectionEPSS 0.3%CVE-2025-10602MEDIUMSourceCodester Online Exam Form Submission delete_s1.php sql injectionEPSS 0.3%CVE-2025-11600MEDIUMcode-projects Simple Food Ordering System editcategory.php sql injectionEPSS 0.3%CVE-2025-11104MEDIUMCodeAstro Electricity Billing System bill.php sql injectionEPSS 0.3%CVE-2025-11613MEDIUMcode-projects Simple Food Ordering System addcategory.php sql injectionEPSS 0.3%CVE-2025-10780MEDIUMCodeAstro Simple Pharmacy Management view.php sql injectionEPSS 0.3%CVE-2025-11611MEDIUMSourceCodester Simple Inventory System user.php sql injectionEPSS 0.3%CVE-2025-10626MEDIUMSourceCodester Online Exam Form Submission update_s3.php sql injectionEPSS 0.3%CVE-2026-30874LOWOpenWrt procd PATH Environment Variable Filter Bypass via Incorrect String Comparison Leads to Privilege EscalationEPSS 0.3%CVE-2025-10625MEDIUMSourceCodester Online Exam Form Submission dashboard.php sql injectionEPSS 0.3%CVE-2026-44458MEDIUMHono: CSS Declaration Injection via Style Object Values in JSX SSREPSS 0.3%CVE-2025-11593MEDIUMCodeAstro Gym Management System delete-equipment.php sql injectionEPSS 0.3%CVE-2025-10613MEDIUMitsourcecode Student Information System leveledit1.php sql injectionEPSS 0.3%CVE-2026-103113MEDIUMOS4ED openSIS-Classic General Information Tab Student.php save action sql injectionEPSS 0.3%CVE-2025-1158MEDIUMESAFENET CDG addPolicyToSafetyGroup.jsp sql injectionEPSS 0.3%CVE-2025-1154MEDIUMxxyopen Novel books sql injectionEPSS 0.3%CVE-2026-13520MEDIUMitsourcecode Hospital Management System Appointment appointmentapproval.php sql injectionEPSS 0.3%CVE-2026-78056MEDIUMsambitraj Student-Management-System Dashboard sql injectionEPSS 0.3%