Weaknesses of type CWE-74

4,824 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-16131MEDIUMitsourcecode Hospital Management System prescriptionrecord.php sql injectionEPSS 0.3%CVE-2026-78656MEDIUMitsourcecode Sales and Inventory System cust_del.php sql injectionEPSS 0.3%CVE-2026-13497MEDIUMitsourcecode Hospital Management System appointment.php sql injectionEPSS 0.3%CVE-2026-75086MEDIUMitsourcecode Hospital Management System viewroom.php sql injectionEPSS 0.3%CVE-2026-15536MEDIUMitsourcecode Hospital Management System patviewprescription.php sql injectionEPSS 0.3%CVE-2026-78864MEDIUMliketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injectionEPSS 0.3%CVE-2026-14659MEDIUMitsourcecode Hospital Management System patientappointment.php sql injectionEPSS 0.3%CVE-2026-14798MEDIUMCodeAstro Apartment Visitor Management System visitor-entry.php sql injectionEPSS 0.3%CVE-2026-86164MEDIUMitsourcecode Sales and Inventory System trans_view.php sql injectionEPSS 0.3%CVE-2026-15523MEDIUMCodeAstro Simple Online Leave Management System dashboard.php sql injectionEPSS 0.3%CVE-2026-14717MEDIUMitsourcecode Hospital Management System patientlogin.php sql injectionEPSS 0.3%CVE-2026-14657MEDIUMcode-projects Assessment Management Database Query marking-scheme.php sql injectionEPSS 0.3%CVE-2026-78057MEDIUMsambitraj Student-Management-System Management Mutation sql injectionEPSS 0.3%CVE-2026-76785MEDIUMamirsanni Mini-Inventory-and-Sales-Management-System Transaction.php getAll sql injectionEPSS 0.3%CVE-2026-86235MEDIUMitsourcecode Sales and Inventory System pos_transac.php add sql injectionEPSS 0.3%CVE-2026-15559MEDIUMCodeAstro Simple Online Leave Management System POST accept.php sql injectionEPSS 0.3%CVE-2026-78185MEDIUMitsourcecode Sales and Inventory System cust_edit.php sql injectionEPSS 0.3%CVE-2026-19923MEDIUMcode-projects Online Shopping System checkout_process.php sql injectionEPSS 0.3%CVE-2026-103690MEDIUMitsourcecode Leave Management System controller.php sql injectionEPSS 0.3%CVE-2026-14694MEDIUMSourceCodester Multi-Vendor Online Grocery Management System POST Parameter Master.php cancel_order sql injectionEPSS 0.3%