Weaknesses of type CWE-74

4,843 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-10286MEDIUMCodeAstro Payroll System home_employee.php sql injectionEPSS 0.2%CVE-2026-11559MEDIUMCodeAstro Payroll System view_account.php sql injectionEPSS 0.2%CVE-2026-10176MEDIUMAider-AI Aider Code Generation Workflow sql injectionEPSS 0.2%CVE-2026-11583MEDIUMCodeAstro Student Attendance Management System createClass.php sql injectionEPSS 0.2%CVE-2026-10265MEDIUMitsourcecode Content Management System edit_topic.php sql injectionEPSS 0.2%CVE-2026-11473MEDIUMjflyfox jfinal_cms AdvicefeedbackController.java list sql injectionEPSS 0.2%CVE-2026-11584MEDIUMCodeAstro Student Attendance Management System createClass.php edit sql injectionEPSS 0.2%CVE-2026-10729LOWHTML injection in the notification email for "Slow Redirect" and "Cloned Website" CanarytokensEPSS 0.2%CVE-2026-105146MEDIUMComsenz Discuz! Admin Medal Moderation mod.php modmedalsubmit sql injectionEPSS 0.2%CVE-2026-101018MEDIUMdayrui XunruiCMS Group Editing Home.php group_all_edit sql injectionEPSS 0.2%CVE-2026-101011MEDIUMaaPanel BaoTa Domain domainMod.py get_domain_status sql injectionEPSS 0.2%CVE-2026-105254MEDIUMitsourcecode Online Admission System schoolyear.php sql injectionEPSS 0.2%CVE-2026-11510MEDIUMCodeAstro Leave Management System add_leave.php sql injectionEPSS 0.2%CVE-2026-96777MEDIUMForma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injectionEPSS 0.2%CVE-2026-10256MEDIUMitsourcecode Content Management System save_comment.php sql injectionEPSS 0.2%CVE-2026-11506MEDIUMCodeAstro Leave Management System search_staff_for_deletion.php sql injectionEPSS 0.2%CVE-2026-104613MEDIUMCodeAstro Simple Pharmacy Management System view.php sql injectionEPSS 0.2%CVE-2026-95833MEDIUMitsourcecode Leave Management System index.php sql injectionEPSS 0.2%CVE-2026-11480MEDIUMChengdu Everbrite Network Technology BeikeShop Admin Design Builder Endpoint admin.php sql injectionEPSS 0.2%CVE-2026-103543MEDIUMitsourcecode Leave Management System controller.php sql injectionEPSS 0.2%