Weaknesses of type CWE-74

4,836 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-9148MEDIUMCodePhiliaX Chat2DB JDBC Connection DataSourceController.java sql injectionEPSS 0.3%CVE-2025-15142MEDIUM9786 phpok3w show.php sql injectionEPSS 0.3%CVE-2025-1797MEDIUMHunan Zhonghe Baiyi Information Technology Baiyiyun Asset Management and Operations System anyUserBoundHouse.php sql injectionEPSS 0.3%CVE-2025-0404MEDIUMliujianview gymxmjpa CoachController.java CoachController sql injectionEPSS 0.3%CVE-2025-1544MEDIUMdingfanzu CMS loadShopInfo.php sql injectionEPSS 0.3%CVE-2025-3318MEDIUMKenj_Frog 肯尼基蛙 company-financial-management 公司财务管理系统 ShangpinleixingController.java page sql injectionEPSS 0.3%CVE-2025-10593MEDIUMSourceCodester Online Student File Management System update_student.php sql injectionEPSS 0.3%CVE-2025-13260MEDIUMCampcodes Supplier Management System edit_product.php sql injectionEPSS 0.3%CVE-2025-13259MEDIUMCampcodes Supplier Management System edit_unit.php sql injectionEPSS 0.3%CVE-2025-4510MEDIUMChangjietong UFIDA CRM optntyday.php sql injectionEPSS 0.3%CVE-2024-2445MEDIUMReflected XSS in Mattermost Jira pluginEPSS 0.3%CVE-2025-13290MEDIUMcode-projects Simple Food Ordering System saveorder.php sql injectionEPSS 0.3%CVE-2025-13273MEDIUMCampcodes School Fees Payment Management System ajax.php sql injectionEPSS 0.3%CVE-2025-14222MEDIUMcode-projects Employee Profile Management System print_personnel_report.php sql injectionEPSS 0.3%CVE-2025-12926MEDIUMSourceCodester Farm Management System review.php sql injectionEPSS 0.3%CVE-2025-13325MEDIUMitsourcecode Student Information System enrollment_edit1.php sql injectionEPSS 0.3%CVE-2025-14230MEDIUMcode-projects Daily Time Recording System add_payroll.php sql injectionEPSS 0.3%CVE-2025-13567MEDIUMitsourcecode COVID Tracking System page sql injectionEPSS 0.3%CVE-2025-13286MEDIUMitsourcecode Online Voting System ajax.php sql injectionEPSS 0.3%CVE-2025-13270MEDIUMCampcodes School Fees Payment Management System ajax.php sql injectionEPSS 0.3%