Weaknesses of type CWE-74

4,843 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-10661MEDIUMahujasid blender-mcp server.py open injectionEPSS 0.2%CVE-2025-11319MEDIUMnahiduddinahammed Hospital-Management-System-Website delete.php sql injectionEPSS 0.2%CVE-2026-10248MEDIUMSourceCodester Pharmacy Sales and Inventory System Supplier Creation export create_supplier csv injectionEPSS 0.2%CVE-2025-11606MEDIUMiPynch Social Network Website Search sql injectionEPSS 0.2%CVE-2025-43267MEDIUMAn injection issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.6. An app may be able to access sensitiveEPSS 0.2%CVE-2025-10399MEDIUMKorzh EasyQuery Query Builder UI fetch sql injectionEPSS 0.2%CVE-2025-7798MEDIUMBeijing Shenzhou Shihan Technology Multimedia Integrated Business Display System companyManage sql injectionEPSS 0.2%CVE-2026-10170MEDIUMcode-projects Visitor Management System phone_0.php sql injectionEPSS 0.2%CVE-2026-81571MEDIUMBrave Popup Builder < 0.8.8 - Unauthenticated Arbitrary Shortcode Execution via UTM ParameterEPSS 0.2%CVE-2026-15256MEDIUMNinja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field DefaultEPSS 0.2%CVE-2026-78363MEDIUMMW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution via Completion Message Merge TagsEPSS 0.2%CVE-2026-80439MEDIUMRedirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthenticated Arbitrary Shortcode Execution via Action Setting Mail-TagsEPSS 0.2%CVE-2026-80437MEDIUMNinja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge TagsEPSS 0.2%CVE-2026-80440MEDIUMHustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message PlaceholdersEPSS 0.2%CVE-2026-10175MEDIUMAider-AI Aider Architect Mode auth.py editor_coder.run code injectionEPSS 0.2%CVE-2026-97225MEDIUMDbGate JSON Runner runners.js code injectionEPSS 0.2%CVE-2026-95868MEDIUMAdithyaYelloju Restaurant-Management-System Search Form display_menu.php mysqli_query sql injectionEPSS 0.2%CVE-2025-14694MEDIUMketr JEPaaS readAllPostil sql injectionEPSS 0.2%CVE-2023-7331MEDIUMPKrystian Full-Stack-Bank User sql injectionEPSS 0.2%CVE-2025-13208MEDIUMFantasticLBP Hotels Server hotelList.php sql injectionEPSS 0.2%