Weaknesses of type CWE-74

4,743 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-4464MEDIUMitsourcecode Gym Management System ajax.php sql injectionEPSS 0.9%CVE-2025-4456MEDIUMProject Worlds Car Rental Project signup.php sql injectionEPSS 0.9%CVE-2025-4466MEDIUMitsourcecode Gym Management System ajax.php sql injectionEPSS 0.9%CVE-2025-4457MEDIUMProject Worlds Car Rental Project approve.php sql injectionEPSS 0.9%CVE-2022-31108MEDIUMArbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.jsEPSS 0.9%CVE-2024-11592MEDIUM1000 Projects Beauty Parlour Management System about-us.php sql injectionEPSS 0.9%CVE-2026-29186HIGH@backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code ExecutionEPSS 0.9%CVE-2026-87909HIGHWP Photo Album Plus <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument InjectionEPSS 0.9%CVE-2024-11962MEDIUMcode-projects Simple Car Rental System login.php sql injectionEPSS 0.9%CVE-2024-1833MEDIUMSourceCodester Employee Management System login.php sql injectionEPSS 0.9%CVE-2025-0298MEDIUMcode-projects Online Book Shop process_login.php sql injectionEPSS 0.9%CVE-2015-10062MEDIUMgalaxy-data-resource Command Line Template injectionEPSS 0.9%CVE-2021-29501HIGHRemote code execution in ticketerEPSS 0.9%CVE-2024-11663MEDIUMCodezips E-Commerce Site search.php sql injectionEPSS 0.9%CVE-2020-15185LOWDuplicated chart entries in HelmEPSS 0.9%CVE-2026-65669CRITICALMicrosoft SQL Server Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2025-67486HIGHDolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafieldsEPSS 0.9%CVE-2024-41127HIGHMonkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its `ci-failure-comment.yml` GitHub Workflow, enabling attackers to gain `pull-requests` write access.EPSS 0.9%CVE-2024-11965MEDIUMPHPGurukul Complaint Management system reset-password.php sql injectionEPSS 0.9%CVE-2024-11966MEDIUMPHPGurukul Complaint Management system index.php sql injectionEPSS 0.9%