Weaknesses of type CWE-74

4,844 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-11506MEDIUMCodeAstro Leave Management System search_staff_for_deletion.php sql injectionEPSS 0.2%CVE-2026-11514MEDIUMitsourcecode Hospital Management System addpatient.php sql injectionEPSS 0.2%CVE-2026-11507MEDIUMCodeAstro Leave Management System delete_leave_type.php sql injectionEPSS 0.2%CVE-2026-104613MEDIUMCodeAstro Simple Pharmacy Management System view.php sql injectionEPSS 0.2%CVE-2026-10209MEDIUMcode-projects Online Hospital Management System Appointment appointmentdetail.php sql injectionEPSS 0.2%CVE-2026-10297MEDIUMitsourcecode Fees Management System manage_course.php sql injectionEPSS 0.2%CVE-2026-11510MEDIUMCodeAstro Leave Management System add_leave.php sql injectionEPSS 0.2%CVE-2026-10235MEDIUMCodeAstro Ingredients Stock Management System stock_manager.php sql injectionEPSS 0.2%CVE-2026-11508MEDIUMCodeAstro Leave Management System search_staff_to_assign_pc.php sql injectionEPSS 0.2%CVE-2026-11495MEDIUMCodeAstro Ingredients Stock Management System add_stock.php sql injectionEPSS 0.2%CVE-2026-96777MEDIUMForma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injectionEPSS 0.2%CVE-2026-104053MEDIUMitsourcecode Pet Shop Management System admin_reservefilter.php sql injectionEPSS 0.2%CVE-2026-105187MEDIUMitsourcecode Online Admission System key.php sql injectionEPSS 0.2%CVE-2026-10808MEDIUMitsourcecode Fees Management System manage_student.php sql injectionEPSS 0.2%CVE-2026-105254MEDIUMitsourcecode Online Admission System schoolyear.php sql injectionEPSS 0.2%CVE-2026-105181MEDIUMitsourcecode Online Admission System register1.php sql injectionEPSS 0.2%CVE-2026-103114MEDIUMOS4ED openSIS-Classic Assignment Management Endpoint Assignments.php DBQuery_assignment sql injectionEPSS 0.2%CVE-2026-10568MEDIUMitsourcecode Fees Management System manage_payment.php sql injectionEPSS 0.2%CVE-2026-104625MEDIUMCodeAstro Simple Loan Management System index.php sql injectionEPSS 0.2%CVE-2026-11513MEDIUMitsourcecode Hospital Management System adminaccount.php sql injectionEPSS 0.2%