Weaknesses of type CWE-74

4,827 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-14706MEDIUMcode-projects Online Examination Quiz Creation Feature update.php sql injectionEPSS 0.3%CVE-2026-82484MEDIUMitsourcecode Sales and Inventory System emp_searchfrm.php sql injectionEPSS 0.3%CVE-2026-19067MEDIUMitsourcecode Hospital Management System treatment.php sql injectionEPSS 0.3%CVE-2026-13541MEDIUMitsourcecode Hospital Management System doctorchangepassword.php sql injectionEPSS 0.3%CVE-2026-92364MEDIUMitsourcecode Leave Management System index.php sql injectionEPSS 0.3%CVE-2026-19917MEDIUMcode-projects Online Food Order System delete_food_items1.php sql injectionEPSS 0.3%CVE-2026-14799MEDIUMCodeAstro Ecommerce Website my_account.php sql injectionEPSS 0.3%CVE-2026-78056MEDIUMsambitraj Student-Management-System Dashboard sql injectionEPSS 0.3%CVE-2026-86163MEDIUMitsourcecode Sales and Inventory System pro_del.php sql injectionEPSS 0.3%CVE-2026-19071MEDIUMitsourcecode Hospital Management System viewappointment.php sql injectionEPSS 0.3%CVE-2026-19934MEDIUMitsourcecode Hospital Management System vieworder.php sql injectionEPSS 0.3%CVE-2026-13532MEDIUMitsourcecode Hospital Management System departmentDoctor.php sql injectionEPSS 0.3%CVE-2026-86310MEDIUMitsourcecode Sales and Inventory System cust_edit1.php sql injectionEPSS 0.3%CVE-2026-86517MEDIUMitsourcecode Sales and Inventory System us_searchfrm.php mysqli_query sql injectionEPSS 0.3%CVE-2026-86269MEDIUMitsourcecode Sales and Inventory System emp_edit1.php sql injectionEPSS 0.3%CVE-2026-82541MEDIUMitsourcecode Sales and Inventory System sup_edit.php sql injectionEPSS 0.3%CVE-2026-90597MEDIUMitsourcecode Sales and Inventory System sup_edit1.php sql injectionEPSS 0.3%CVE-2026-82421MEDIUMitsourcecode Sales and Inventory System emp_edit.php sql injectionEPSS 0.3%CVE-2026-7290MEDIUMJeecgBoot loadDict Endpoint SqlInjectionUtil.java SqlInjectionUtil sql injectionEPSS 0.3%CVE-2026-19894MEDIUMitsourcecode Hospital Management System viewmedicine.php sql injectionEPSS 0.3%