Weaknesses of type CWE-74

4,830 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-5563MEDIUMAutohomeCorp frostmourne Alarm Preview previewData httpTest sql injectionEPSS 0.3%CVE-2026-7143MEDIUM1000 Projects Portfolio Management System MCA block_status.php sql injectionEPSS 0.3%CVE-2026-7447MEDIUMSourceCodester Pet Grooming Management Software update_customer.php sql injectionEPSS 0.3%CVE-2026-4614MEDIUMitsourcecode sanitize or validate this input Parameter subjects.php sql injectionEPSS 0.3%CVE-2026-7118MEDIUMcode-projects Employee Management System cancel.php sql injectionEPSS 0.3%CVE-2026-9342MEDIUMSourceCodester Hospitals Patient Records Management System view_history.php sql injectionEPSS 0.3%CVE-2026-5537MEDIUMhalex CourseSEL HTTP GET Parameter IndexController.class.php check_sel sql injectionEPSS 0.3%CVE-2026-6007MEDIUMitsourcecode Construction Management System del.php sql injectionEPSS 0.3%CVE-2026-7591MEDIUMTimBroddin astro-mcp-server MCP Tool Query Construction index.ts sql injectionEPSS 0.3%CVE-2026-4574MEDIUMSourceCodester Simple E-learning System User Profile Update sql injectionEPSS 0.3%CVE-2026-7265MEDIUMSourceCodester Pizzafy Ecommerce System index.php category sql injectionEPSS 0.3%CVE-2026-5560MEDIUMPHPGurukul Online Shopping Portal Project Parameter payment-method.php sql injectionEPSS 0.3%CVE-2026-4230MEDIUMvanna-ai vanna Endpoint __init__.py update_sql sql injectionEPSS 0.3%CVE-2026-7783MEDIUMCodeCanyon Perfex CRM Admin Kanban Endpoint AbstractKanban.php applySortQuery sql injectionEPSS 0.3%CVE-2026-4836MEDIUMcode-projects Accounting System delete.php sql injectionEPSS 0.3%CVE-2026-7822MEDIUMitsourcecode Courier Management System print_pdets.php sql injectionEPSS 0.3%CVE-2026-7745MEDIUMCodeAstro Online Classroom facultydetails sql injectionEPSS 0.3%CVE-2026-9411MEDIUMSourceCodester Indian Invoicing System Invoice Generation IGST_Invoice.php sql injectionEPSS 0.3%CVE-2026-4173MEDIUMCodePhiliaX Chat2DB Database Export DMDBManage.java updateProcedure sql injectionEPSS 0.3%CVE-2026-94492MEDIUMYonyou U8cloud OpenAPI so.saleorder.sendaudit sql injectionEPSS 0.3%