Weaknesses of type CWE-74

4,841 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-19179HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.3%CVE-2025-12861MEDIUMDedeBIZ spec_add.php sql injectionEPSS 0.3%CVE-2025-12927MEDIUMDedeBIZ archives_add.php sql injectionEPSS 0.3%CVE-2025-12860MEDIUMDedeBIZ freelist_main.php sql injectionEPSS 0.3%CVE-2026-19964MEDIUMJij-Inc Jij-MCP-Server jm_check python_repr.py PythonREPL.run code injectionEPSS 0.3%CVE-2025-12859MEDIUMDedeBIZ templets_one_edit.php sql injectionEPSS 0.3%CVE-2026-81833MEDIUMRooCodeInc Roo-Code CodeIndexManager helpers.ts optimizeQuery code injectionEPSS 0.3%CVE-2026-81835MEDIUMRooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injectionEPSS 0.3%CVE-2026-35515MEDIUM@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')EPSS 0.3%CVE-2026-24043MEDIUMjsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation)EPSS 0.3%CVE-2025-12249MEDIUMAxosoft Scrum and Bug Tracking Edit Ticket csv injectionEPSS 0.3%CVE-2025-15392MEDIUMKohana KodiCMS Search API Endpoint page.php like sql injectionEPSS 0.3%CVE-2025-13575MEDIUMcode-projects Blog Site Category blog.php category_exists sql injectionEPSS 0.3%CVE-2025-5782MEDIUMPHPGurukul Employee Record Management System resetpassword.php sql injectionEPSS 0.3%CVE-2025-24374MEDIUMTwig fixes a security issue where escaping was missing when using null coalesce operator (??)EPSS 0.3%CVE-2026-11482MEDIUMSourceCodester Class and Exam Timetabling System archive5.php sql injectionEPSS 0.3%CVE-2026-11490MEDIUMcode-projects Online Music Site Search.php sql injectionEPSS 0.3%CVE-2026-77353MEDIUMWallos: iCalendar Injection via CRLF in Subscription Name/Notes ExportEPSS 0.3%CVE-2025-8808MEDIUMxujeff tianti 天梯 com.jeff.tianti.controller save exportOrder csv injectionEPSS 0.3%CVE-2025-13172MEDIUMCodeAstro Gym Management System view-member-report.php sql injectionEPSS 0.3%