Weaknesses of type CWE-74

4,825 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-19917MEDIUMcode-projects Online Food Order System delete_food_items1.php sql injectionEPSS 0.3%CVE-2026-19347MEDIUMitsourcecode Hospital Management System viewdoctor.php sql injectionEPSS 0.3%CVE-2026-92364MEDIUMitsourcecode Leave Management System index.php sql injectionEPSS 0.3%CVE-2026-86270MEDIUMitsourcecode Sales and Inventory System settings_edit.php sql injectionEPSS 0.3%CVE-2026-13572MEDIUMitsourcecode Hospital Management System insertbillingrecord.php sql injectionEPSS 0.3%CVE-2026-86235MEDIUMitsourcecode Sales and Inventory System pos_transac.php add sql injectionEPSS 0.3%CVE-2026-90796MEDIUMitsourcecode Leave Management System index.php sql injectionEPSS 0.3%CVE-2026-86265MEDIUMitsourcecode Sales and Inventory System us_transac.php sql injectionEPSS 0.3%CVE-2026-20000MEDIUMitsourcecode Hospital Management System viewprescriptionrecord.php sql injectionEPSS 0.3%CVE-2026-76785MEDIUMamirsanni Mini-Inventory-and-Sales-Management-System Transaction.php getAll sql injectionEPSS 0.3%CVE-2026-14701MEDIUMcode-projects Internship Management System Password Change Endpoint change_password.php sql injectionEPSS 0.3%CVE-2026-13541MEDIUMitsourcecode Hospital Management System doctorchangepassword.php sql injectionEPSS 0.3%CVE-2026-78185MEDIUMitsourcecode Sales and Inventory System cust_edit.php sql injectionEPSS 0.3%CVE-2026-14657MEDIUMcode-projects Assessment Management Database Query marking-scheme.php sql injectionEPSS 0.3%CVE-2026-86291MEDIUMitsourcecode Sales and Inventory System us_edit1.php sql injectionEPSS 0.3%CVE-2026-82484MEDIUMitsourcecode Sales and Inventory System emp_searchfrm.php sql injectionEPSS 0.3%CVE-2026-14706MEDIUMcode-projects Online Examination Quiz Creation Feature update.php sql injectionEPSS 0.3%CVE-2026-76991MEDIUMitsourcecode Hospital Management System viewappointmentapproved.php sql injectionEPSS 0.3%CVE-2026-19068MEDIUMitsourcecode Hospital Management System treatmentdetail.php sql injectionEPSS 0.3%CVE-2026-14717MEDIUMitsourcecode Hospital Management System patientlogin.php sql injectionEPSS 0.3%