Weaknesses of type CWE-74

4,829 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-2604MEDIUMSourceCodester Kortex Lite Advocate Office Management System edit_act.php sql injectionEPSS 0.3%CVE-2024-35728MEDIUMWordPress Product Addons & Fields for WooCommerce plugin <= 32.0.20 - Content Injection vulnerabilityEPSS 0.3%CVE-2026-41319MEDIUMMailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgradeEPSS 0.3%CVE-2026-41885MEDIUMPath traversal / URL injection via unsanitised lng/ns/projectId/version in i18next-locize-backendEPSS 0.3%CVE-2025-12266MEDIUMZytec Dalian Zhuoyun Technology Central Authentication Service widget _empty code injectionEPSS 0.3%CVE-2023-23738MEDIUMWordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Unauthenticated Email Spoofing VulnerabilityEPSS 0.3%CVE-2026-3672MEDIUMJeecgBoot getDictItems isExistSqlInjectKeyword sql injectionEPSS 0.3%CVE-2025-14674MEDIUMaizuda snail-job QLExpressEngine.java QLExpressEngine.doEval injectionEPSS 0.3%CVE-2025-64099HIGHOpenAM allows use of arbitrary OIDC requested claims values in id_token and user_infoEPSS 0.3%CVE-2026-2553MEDIUMtushar-2223 Hotel-Management-System HTTP POST Request home.php sql injectionEPSS 0.3%CVE-2026-2963MEDIUMJinher OA C6 OfficeSupplyTypeRight.aspx sql injectionEPSS 0.3%CVE-2026-11457MEDIUMerzhongxmu JeeWMS JimuReport test-connection Endpoint testConnection injectionEPSS 0.3%CVE-2026-104123MEDIUMSourceCodester Online Reviewer Management System btn_functions.php activity sql injectionEPSS 0.3%CVE-2025-9150MEDIUMSurbowl dormitory-management-php violation_add.php sql injectionEPSS 0.3%CVE-2025-10973MEDIUMJackieDYH Resume-management-system show.php sql injectionEPSS 0.3%CVE-2025-10477MEDIUMkidaze CourseSelectionSystem eligibility.php sql injectionEPSS 0.3%CVE-2026-10877MEDIUMSourceCodester Ship Ferry Ticket Reservation System Admin Login login.php sql injectionEPSS 0.3%CVE-2026-11530MEDIUMimvks786 student_management_system Login index.ph sql injectionEPSS 0.3%CVE-2026-11531MEDIUMimvks786 student_management_system Administrator Login Endpoint admin_login.php sql injectionEPSS 0.3%CVE-2025-10967MEDIUMMuFen-mker PHP-Usermm chkuser.php sql injectionEPSS 0.3%