Weaknesses of type CWE-74

4,743 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2024-11965MEDIUMPHPGurukul Complaint Management system reset-password.php sql injectionEPSS 0.9%CVE-2023-51446MEDIUMGLPI LDAP Injection during authenticationEPSS 0.9%CVE-2024-12497MEDIUM1000 Projects Attendance Tracking Management System check_admin_login.php sql injectionEPSS 0.9%CVE-2022-35735HIGHBIG-IP monitor configuration vulnerability CVE-2022-35735EPSS 0.9%CVE-2026-41109HIGHGitHub Copilot and Visual Studio Code Security Feature Bypass VulnerabilityEPSS 0.9%CVE-2024-11956MEDIUMPimcore customer-data-framework list sql injectionEPSS 0.9%CVE-2020-15111MEDIUMCRLF vulnerability in FiberEPSS 0.9%CVE-2023-45303HIGHThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supEPSS 0.9%CVE-2024-34919CRITICALAn arbitrary file upload vulnerability in the component \modstudent\controller.php of Pisay Online E-Learning System using PHP/MySQL v1.0 alEPSS 0.9%CVE-2024-11649MEDIUM1000 Projects Beauty Parlour Management System search-appointment.php sql injectionEPSS 0.9%CVE-2024-11648MEDIUM1000 Projects Beauty Parlour Management System add-customer.php sql injectionEPSS 0.9%CVE-2024-11590MEDIUM1000 Projects Bookstore Management System forget_password_process.php sql injectionEPSS 0.9%CVE-2024-11647MEDIUM1000 Projects Beauty Parlour Management System view-appointment.php sql injectionEPSS 0.9%CVE-2023-26261CRITICALIn UBIKA WAAP Gateway/Cloud through 6.10, a blind XPath injection leads to an authentication bypass by stealing the session of another conneEPSS 0.8%CVE-2025-4458MEDIUMcode-projects Patient Record Management System edit_upatient.php sql injectionEPSS 0.8%CVE-2025-4459MEDIUMcode-projects Patient Record Management System fecalysis_form.php sql injectionEPSS 0.8%CVE-2020-26260MEDIUMServer Side Request Forgery in BookStackEPSS 0.8%CVE-2025-5579MEDIUMPHPGurukul Dairy Farm Shop Management System search-product.php sql injectionEPSS 0.8%CVE-2021-29502HIGHRemote code execution in the WarnSystem module of Laggrons-Dumb-CogsEPSS 0.8%CVE-2024-23648HIGHPimcore Admin Classic Bundle host header injection in the password resetEPSS 0.8%