Weaknesses of type CWE-74

4,821 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-86245MEDIUMitsourcecode Sales and Inventory System sup_transac.php sql injectionEPSS 0.3%CVE-2026-13535MEDIUMCodeAstro Human Resource Management System View Endpoint Employee_model.php GetFileInfo sql injectionEPSS 0.3%CVE-2026-14797MEDIUMCodeAstro Apartment Visitor Management System edit-apartment.php sql injectionEPSS 0.3%CVE-2026-86310MEDIUMitsourcecode Sales and Inventory System cust_edit1.php sql injectionEPSS 0.3%CVE-2026-13578MEDIUMitsourcecode Hospital Management System patientdetail.php sql injectionEPSS 0.3%CVE-2026-19070MEDIUMitsourcecode Hospital Management System viewadmin.php sql injectionEPSS 0.3%CVE-2026-16490MEDIUMitsourcecode Hospital Management System prescription.php sql injectionEPSS 0.3%CVE-2026-5328MEDIUMshsuishang modulithshop ProductItemDao ProductIndexServiceImpl.java listItem sql injectionEPSS 0.3%CVE-2026-90796MEDIUMitsourcecode Leave Management System index.php sql injectionEPSS 0.3%CVE-2026-13531MEDIUMitsourcecode Hospital Management System department.php sql injectionEPSS 0.3%CVE-2026-19917MEDIUMcode-projects Online Food Order System delete_food_items1.php sql injectionEPSS 0.3%CVE-2026-13572MEDIUMitsourcecode Hospital Management System insertbillingrecord.php sql injectionEPSS 0.3%CVE-2026-82609MEDIUMitsourcecode Sales and Inventory System inv_edit.php sql injectionEPSS 0.3%CVE-2026-86270MEDIUMitsourcecode Sales and Inventory System settings_edit.php sql injectionEPSS 0.3%CVE-2026-13542MEDIUMitsourcecode Hospital Management System doctorprofile.php sql injectionEPSS 0.3%CVE-2026-78112MEDIUMitsourcecode Hospital Management System Project in PHP viewservicetype.php sql injectionEPSS 0.3%CVE-2026-14638MEDIUMitsourcecode Hospital Management System patient.php sql injectionEPSS 0.3%CVE-2026-19934MEDIUMitsourcecode Hospital Management System vieworder.php sql injectionEPSS 0.3%CVE-2026-5620MEDIUMitsourcecode Construction Management System Parameter borrowed_equip_report.php sql injectionEPSS 0.3%CVE-2026-19347MEDIUMitsourcecode Hospital Management System viewdoctor.php sql injectionEPSS 0.3%