Weaknesses of type CWE-74

4,815 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-86517MEDIUMitsourcecode Sales and Inventory System us_searchfrm.php mysqli_query sql injectionEPSS 0.3%CVE-2026-103690MEDIUMitsourcecode Leave Management System controller.php sql injectionEPSS 0.3%CVE-2026-90600MEDIUMitsourcecode Sales and Inventory System inv_edit1.php sql injectionEPSS 0.3%CVE-2026-15558MEDIUMCodeAstro Simple Online Leave Management System deletemp.php sql injectionEPSS 0.3%CVE-2026-16334MEDIUMitsourcecode Hospital Management System prescriptionorder.php sql injectionEPSS 0.3%CVE-2026-86163MEDIUMitsourcecode Sales and Inventory System pro_del.php sql injectionEPSS 0.3%CVE-2026-78656MEDIUMitsourcecode Sales and Inventory System cust_del.php sql injectionEPSS 0.3%CVE-2026-19972MEDIUMitsourcecode Hospital Management System viewpatient.php sql injectionEPSS 0.3%CVE-2026-86267MEDIUMitsourcecode Information System Society Membership System check_student.php sql injectionEPSS 0.3%CVE-2026-86675MEDIUMitsourcecode Sales and Inventory System us_edit.php sql injectionEPSS 0.3%CVE-2026-15672MEDIUMitsourcecode Electronic Judging System add_judges.php sql injectionEPSS 0.3%CVE-2026-14619MEDIUMitsourcecode Hospital Management System medicine.php sql injectionEPSS 0.3%CVE-2026-19921MEDIUMcode-projects Online Shopping System homeaction.php sql injectionEPSS 0.3%CVE-2026-86310MEDIUMitsourcecode Sales and Inventory System cust_edit1.php sql injectionEPSS 0.3%CVE-2026-19071MEDIUMitsourcecode Hospital Management System viewappointment.php sql injectionEPSS 0.3%CVE-2026-13532MEDIUMitsourcecode Hospital Management System departmentDoctor.php sql injectionEPSS 0.3%CVE-2026-82609MEDIUMitsourcecode Sales and Inventory System inv_edit.php sql injectionEPSS 0.3%CVE-2026-13530MEDIUMitsourcecode Hospital Management System Appointment appointmentdetail.php sql injectionEPSS 0.3%CVE-2026-19364MEDIUMitsourcecode Hospital Management System viewdoctorconsultancycharge.php sql injectionEPSS 0.3%CVE-2026-82485MEDIUMitsourcecode Sales and Inventory System pro_edit.php sql injectionEPSS 0.3%