Weaknesses of type CWE-74

4,841 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-10253MEDIUMitsourcecode Online House Rental System manage_payment.php sql injectionEPSS 0.3%CVE-2026-105185MEDIUMitsourcecode Online Admission System examinee.php sql injectionEPSS 0.3%CVE-2026-10208MEDIUMcode-projects Online Hospital Management System login_1.php login_user sql injectionEPSS 0.3%CVE-2026-105247MEDIUMSourceCodester Online Reviewer Management System btn_functions.php course sql injectionEPSS 0.3%CVE-2026-105232MEDIUMkishor-23 food-waste-management-system Registration deliverysignup.php sql injectionEPSS 0.3%CVE-2026-105172MEDIUMitsourcecode Online Admission System login1.php sql injectionEPSS 0.3%CVE-2026-11342MEDIUMcode-projects Hotel and Tourism Reservation System details.php sql injectionEPSS 0.3%CVE-2026-10225MEDIUMraisulislamg4 student_management_system_by_php Login login_check.php sql injectionEPSS 0.3%CVE-2026-11472MEDIUMSourceCodester Class and Exam Timetabling System index1.php sql injectionEPSS 0.3%CVE-2026-102908MEDIUMSourceCodester Online Reviewer Management System questions-view.php sql injectionEPSS 0.3%CVE-2026-105182MEDIUMSourceCodester Online Reviewer Management System btn_functions.php update sql injectionEPSS 0.3%CVE-2026-10237MEDIUMSourceCodester Water Billing Management System User Management manage_user sql injectionEPSS 0.3%CVE-2026-103117MEDIUMOS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injectionEPSS 0.3%CVE-2025-5373MEDIUMPHPGurukul Online Birth Certificate System users-applications.php sql injectionEPSS 0.3%CVE-2026-11456MEDIUMChanjet CRM HTTP GET Request jxf_dump_systable.php sql injectionEPSS 0.3%CVE-2026-47162HIGHVim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory nameEPSS 0.3%CVE-2025-11628MEDIUMjimit105 Project-Online-Shopping-Website Product Inventory delete.php sql injectionEPSS 0.3%CVE-2025-9802MEDIUMRemoteClinic profile.php sql injectionEPSS 0.3%CVE-2026-105149MEDIUMmooSocial all-products sql injectionEPSS 0.3%CVE-2026-11435MEDIUMJinher OA nextselectplan.aspx sql injectionEPSS 0.3%