Weaknesses of type CWE-74

4,847 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-86612MEDIUMNinja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Data SourceEPSS 0.2%CVE-2025-13462LOWtarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handlingEPSS 0.2%CVE-2026-95832CRITICALReflected unknown field names in the kitty colour control escape code allow command execution in the user's shellEPSS 0.2%CVE-2026-0972MEDIUMHTML Injection possible in system generated emails in Fortra's GoAnywhere MFTEPSS 0.2%CVE-2026-86604MEDIUMGTranslate < 5.0.1 - Unauthenticated Arbitrary Shortcode Execution via Email TranslationEPSS 0.2%CVE-2025-69205MEDIUMIn µURU, a Specially Crafted Federation Name Allows Dialplan InjectionEPSS 0.1%CVE-2026-11475MEDIUMKushan2k student-management-system Certificate Verification Endpoint GradeController.php getStatus sql injectionEPSS 0.1%CVE-2026-0864MEDIUMConfiguration Injection via Carriage Return (\r) in write() methodEPSS 0.1%CVE-2026-81523LOWCross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocryptEPSS 0.1%CVE-2026-105469MEDIUMgirishsaraf Online-Appointment-Booking-System AJAX Endpoint get_town.php sql injectionEPSS —CVE-2026-105384MEDIUMUNION HospitalManagementSystem patient_info.php sql injectionEPSS —CVE-2026-105383MEDIUMonetwothreeneth HospitalManagementSystem controller.php sql injectionEPSS —CVE-2026-82989CRITICALCVE-2026-82989EPSS —CVE-2026-105776MEDIUMbhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL admin_transaction.php sql injectionEPSS —CVE-2026-105388MEDIUMfeelec-yishu feelcrm-os Member Endpoint MemberController.class.php index sql injectionEPSS —CVE-2026-105919MEDIUMKusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injectionEPSS —CVE-2026-105471MEDIUMgirishsaraf Online-Appointment-Booking-System Registration signup.php sql injectionEPSS —CVE-2026-105918MEDIUMKusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injectionEPSS —CVE-2026-105470MEDIUMgirishsaraf Online-Appointment-Booking-System Doctor Search Endpoint locateus.php mysqli_query sql injectionEPSS —CVE-2026-105807MEDIUMSourceCodester Simple Student Information System searchquery.php sql injectionEPSS —