Weaknesses of type CWE-74

4,743 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-27787HIGHApplio allows a DoS in restart.pyEPSS 0.8%CVE-2024-7219MEDIUMSourceCodester/Campcodes School Log Management System ajax.php sql injectionEPSS 0.8%CVE-2025-3690MEDIUMPHPGurukul Men Salon Management System edit-services.php sql injectionEPSS 0.8%CVE-2024-11646MEDIUM1000 Projects Beauty Parlour Management System edit-services.php sql injectionEPSS 0.8%CVE-2024-12884MEDIUMCodezips E-Commerce Website login.php sql injectionEPSS 0.8%CVE-2026-54680CRITICALLogging operator has Fluentd configuration injection that allows remote code executionEPSS 0.8%CVE-2015-10040MEDIUMgitlearn Escape Sequence config.sh getOutOf injectionEPSS 0.8%CVE-2026-33202MEDIUMRails Active Storage has possible glob injection in its DiskServiceEPSS 0.8%CVE-2026-76221HIGHGitPython before 3.1.58 Config Injection via option-nameEPSS 0.8%CVE-2026-32622HIGHSQLBot: Remote Code Execution via Terminology PoisoningEPSS 0.8%CVE-2024-3767MEDIUMPHPGurukul News Portal edit-post.php sql injectionEPSS 0.8%CVE-2026-45344HIGHLinkAce: Setup database password newline injection enables pre-auth RCE on uninitialized instancesEPSS 0.8%CVE-2025-10097MEDIUMSimStudioAI sim route.ts code injectionEPSS 0.8%CVE-2024-12490MEDIUMcode-projects Online Class and Exam Scheduling System teacher_save.php sql injectionEPSS 0.8%CVE-2023-1061MEDIUMSourceCodester Doctors Appointment System edit-doc.php sql injectionEPSS 0.8%CVE-2023-1059MEDIUMSourceCodester Doctors Appointment System Parameter doctors.php sql injectionEPSS 0.8%CVE-2024-13038MEDIUMCodeAstro Simple Loan Management System Login index.php sql injectionEPSS 0.8%CVE-2024-49381HIGHPlenti arbitrary file deletion vulnerabilityEPSS 0.8%CVE-2025-2217MEDIUMzzskzy Warehouse Refinement Management System getAdyData.ashx ProcessRequest sql injectionEPSS 0.8%CVE-2022-47052MEDIUMThe web interface of the 'Nighthawk R6220 AC1200 Smart Wi-Fi Router' is vulnerable to a CRLF Injection attack that can be leveraged to perfoEPSS 0.8%