Weaknesses of type CWE-74

4,818 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-19020MEDIUMitsourcecode Hospital Management System servicetype.php sql injectionEPSS 0.3%CVE-2026-19973MEDIUMitsourcecode Hospital Management System viewpaymentreport.php sql injectionEPSS 0.3%CVE-2026-82696MEDIUMitsourcecode Sales and Inventory System inv_searchfrm.php sql injectionEPSS 0.3%CVE-2026-14703MEDIUMitsourcecode Hospital Management System patientorder.php sql injectionEPSS 0.3%CVE-2026-77025MEDIUMitsourcecode Hospital Management System viewappointmentpending.php sql injectionEPSS 0.3%CVE-2026-14638MEDIUMitsourcecode Hospital Management System patient.php sql injectionEPSS 0.3%CVE-2026-19071MEDIUMitsourcecode Hospital Management System viewappointment.php sql injectionEPSS 0.3%CVE-2026-13532MEDIUMitsourcecode Hospital Management System departmentDoctor.php sql injectionEPSS 0.3%CVE-2026-82422MEDIUMitsourcecode Sales and Inventory System emp_del.php sql injectionEPSS 0.3%CVE-2026-86518MEDIUMcode-projects Student Crud Operation edit.php sql injectionEPSS 0.3%CVE-2026-82541MEDIUMitsourcecode Sales and Inventory System sup_edit.php sql injectionEPSS 0.3%CVE-2026-14751MEDIUMmjperpinosa stumasy search_scratch_data.php search_scratch_data sql injectionEPSS 0.3%CVE-2026-14701MEDIUMcode-projects Internship Management System Password Change Endpoint change_password.php sql injectionEPSS 0.3%CVE-2026-86675MEDIUMitsourcecode Sales and Inventory System us_edit.php sql injectionEPSS 0.3%CVE-2026-76997MEDIUMSourceCodester Simple Online Food Ordering System ajax.php save_category sql injectionEPSS 0.3%CVE-2026-13542MEDIUMitsourcecode Hospital Management System doctorprofile.php sql injectionEPSS 0.3%CVE-2026-14659MEDIUMitsourcecode Hospital Management System patientappointment.php sql injectionEPSS 0.3%CVE-2026-19972MEDIUMitsourcecode Hospital Management System viewpatient.php sql injectionEPSS 0.3%CVE-2026-86236MEDIUMitsourcecode Sales and Inventory System pro_transac.php add sql injectionEPSS 0.3%CVE-2026-19917MEDIUMcode-projects Online Food Order System delete_food_items1.php sql injectionEPSS 0.3%