Weaknesses of type CWE-74

4,829 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-12242MEDIUMCodeAstro Gym Management System check-attendance.php sql injectionEPSS 0.3%CVE-2025-11359MEDIUMcode-projects Simple Banking System transfermoney.php sql injectionEPSS 0.3%CVE-2026-5838MEDIUMPHPGurukul News Portal Project add-subadmins.php sql injectionEPSS 0.3%CVE-2026-2090MEDIUMSourceCodester Online Class Record System search.php sql injectionEPSS 0.3%CVE-2026-7293MEDIUMSourceCodester Pizzafy Ecommerce System ajax.php delete_category sql injectionEPSS 0.3%CVE-2026-4189MEDIUMphpipam Section edit-result.php sql injectionEPSS 0.3%CVE-2025-14214MEDIUMitsourcecode Student Information System section_edit1.php sql injectionEPSS 0.3%CVE-2026-7408MEDIUMSourceCodester Pizzafy Ecommerce System ajax.php save_menu sql injectionEPSS 0.3%CVE-2026-2087MEDIUMSourceCodester Online Class Record System login.php sql injectionEPSS 0.3%CVE-2025-11409MEDIUMCampcodes Advanced Online Voting Management System index.php sql injectionEPSS 0.3%CVE-2026-7283MEDIUMSourceCodester Pharmacy Sales and Inventory System ajax.php save_expired sql injectionEPSS 0.3%CVE-2025-5384MEDIUMJeeWMS cgAutoListController.do CgAutoListController sql injectionEPSS 0.3%CVE-2026-7083MEDIUMlikeadmin-likeshop likeadmin_php dataTable Admin API DataTableLists.php queryResult sql injectionEPSS 0.3%CVE-2026-18592MEDIUMosCommerce Email Template Configuration EmailController.php EmailController sql injectionEPSS 0.3%CVE-2026-7028MEDIUMCodeAstro Online Job Portal All Jobs delete-jobs.php sql injectionEPSS 0.3%CVE-2025-13287MEDIUMitsourcecode Online Voting System index.php sql injectionEPSS 0.3%CVE-2026-41319MEDIUMMailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgradeEPSS 0.3%CVE-2026-32616HIGHPigeon has a Host Header Injection in email verification flowEPSS 0.3%CVE-2026-12812MEDIUMRadware Cyber Controller HTML Report Generation HTML injectionEPSS 0.3%CVE-2025-2593MEDIUMFastCMS list sql injectionEPSS 0.3%