Weaknesses of type CWE-74

4,839 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-10608MEDIUMDedeCMS carbuyaction.php RemoveXSS sql injectionEPSS 0.3%CVE-2025-13273MEDIUMCampcodes School Fees Payment Management System ajax.php sql injectionEPSS 0.3%CVE-2025-13325MEDIUMitsourcecode Student Information System enrollment_edit1.php sql injectionEPSS 0.3%CVE-2025-13567MEDIUMitsourcecode COVID Tracking System page sql injectionEPSS 0.3%CVE-2025-13571MEDIUMcode-projects Simple Food Ordering System listorder.php sql injectionEPSS 0.3%CVE-2025-14230MEDIUMcode-projects Daily Time Recording System add_payroll.php sql injectionEPSS 0.3%CVE-2025-13274MEDIUMCampcodes School Fees Payment Management System ajax.php sql injectionEPSS 0.3%CVE-2025-13269MEDIUMCampcodes School Fees Payment Management System ajax.php sql injectionEPSS 0.3%CVE-2025-13286MEDIUMitsourcecode Online Voting System ajax.php sql injectionEPSS 0.3%CVE-2024-46452MEDIUMA Host Header injection vulnerability in the password reset function of VigyBag Open Source Online Shop commit 3f0e21b allows attackers to rEPSS 0.3%CVE-2025-13289MEDIUM1000projects Design & Development of Student Database Management System SubjectDetails.php sql injectionEPSS 0.3%CVE-2025-13580MEDIUMcode-projects Library System mail.php sql injectionEPSS 0.3%CVE-2026-19848MEDIUMProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display NameEPSS 0.3%CVE-2026-85113MEDIUMGiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor NameEPSS 0.3%CVE-2025-13579MEDIUMcode-projects Library System return.php sql injectionEPSS 0.3%CVE-2025-13347MEDIUMSourceCodester Train Station Ticketing System ajax.php sql injectionEPSS 0.3%CVE-2025-13346MEDIUMSourceCodester Train Station Ticketing System ajax.php sql injectionEPSS 0.3%CVE-2026-6991MEDIUMcolinhacks Zod CUID Data Type regexes.ts sql injectionEPSS 0.3%CVE-2026-85117MEDIUMContact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field RepopulationEPSS 0.3%CVE-2026-85116MEDIUMSimple CAPTCHA with Cloudflare Turnstile 1.2.2 - 1.42.1 - Unauthenticated Arbitrary Shortcode Execution via Contact Form 7 Field RepopulationEPSS 0.3%