Weaknesses of type CWE-74

4,840 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2024-25673MEDIUMCouchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions allows HTTP Host header injection.EPSS 0.3%CVE-2025-2358MEDIUMShenzhen Mingyuan Cloud Technology Mingyuan Real Estate ERP System HTTP Header Service.asmx sql injectionEPSS 0.3%CVE-2024-21838MEDIUM Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Centre Server could leadEPSS 0.3%CVE-2026-10220MEDIUMNousResearch hermes-agent skills_tool.py skill_view injectionEPSS 0.3%CVE-2026-10221MEDIUMNousResearch hermes-agent run_agent.py _compress_context injectionEPSS 0.3%CVE-2026-97886MEDIUMmathurvishal CloudClassroom-PHP-Project managevideos2.php sql injectionEPSS 0.3%CVE-2026-29085MEDIUMHono: SSE Control Field Injection via CR/LF in writeSSE()EPSS 0.3%CVE-2026-100894MEDIUMmathurvishal CloudClassroom-PHP-Project updateguest.php sql injectionEPSS 0.3%CVE-2026-10874MEDIUMprojectworlds Online Art Gallery Shop Project adminHome.php sql injectionEPSS 0.3%CVE-2026-10875MEDIUMprojectworlds Online Art Gallery Shop Project adminHome.ph sql injectionEPSS 0.3%CVE-2025-14091MEDIUMTrippWasTaken PHP-Guitar-Shop Product Details product.php sql injectionEPSS 0.3%CVE-2025-14190MEDIUMChanjet TPlus sql injectionEPSS 0.3%CVE-2025-14189MEDIUMChanjet CRM jxf_dump_table_demo.php sql injectionEPSS 0.3%CVE-2025-15140MEDIUMsaiftheboss7 onlinemcqexam quesadd.php sql injectionEPSS 0.3%CVE-2025-14207MEDIUMtushar-2223 Hotel-Management-System invoiceprint.php sql injectionEPSS 0.3%CVE-2025-6100MEDIUMrealguoshuai open-video-cms list sql injectionEPSS 0.3%CVE-2025-13276MEDIUMg33kyrash Online-Banking-System index.php sql injectionEPSS 0.3%CVE-2025-13395MEDIUMcodehub666 94list function.php login sql injectionEPSS 0.3%CVE-2026-59296MEDIUMMicrometer StatsD and Logging meter registries line-protocol and log injection vulnerabilityEPSS 0.3%CVE-2025-6768MEDIUMsfturing hosp_order HospitalServiceImpl.java findAllHosByCondition sql injectionEPSS 0.3%