Weaknesses of type CWE-74

4,743 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2024-10967MEDIUMcode-projects E-Health Care System delete_user_appointment_request.php sql injectionEPSS 0.8%CVE-2026-54159CRITICALps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCEEPSS 0.8%CVE-2023-3694MEDIUMSourceCodester/projectworlds House Rental and Property Listing index.php sql injectionEPSS 0.8%CVE-2024-12960MEDIUM1000 Projects Portfolio Management System MCA update_edu_details.php sql injectionEPSS 0.7%CVE-2024-12959MEDIUM1000 Projects Portfolio Management System MCA update_personal_details.php sql injectionEPSS 0.7%CVE-2024-12958MEDIUM1000 Projects Portfolio Management System MCA update_pro_details.php sql injectionEPSS 0.7%CVE-2025-0564MEDIUMcode-projects Fantasy-Cricket authenticate.php sql injectionEPSS 0.7%CVE-2024-13004MEDIUMPHPGurukul Complaint Management System category.php sql injectionEPSS 0.7%CVE-2024-11257MEDIUM1000 Projects Beauty Parlour Management System forgot-password.php sql injectionEPSS 0.7%CVE-2024-11967MEDIUMPHPGurukul Complaint Management system reset-password.php sql injectionEPSS 0.7%CVE-2024-11744MEDIUM1000 Projects Portfolio Management System MCA register.php sql injectionEPSS 0.7%CVE-2024-47764MEDIUMcookie accepts cookie name, path, and domain with out of bounds charactersEPSS 0.7%CVE-2026-34041HIGHact: Unrestricted set-env and add-path command processing enables environment injectionEPSS 0.7%CVE-2022-3962MEDIUMKiali: error message spoofing in kiali uiEPSS 0.7%CVE-2025-24962HIGHCommand Injection in reNgineEPSS 0.7%CVE-2024-41121HIGHCustom workspace allow to overwrite plugin entrypoint executable in WoodpeckerEPSS 0.7%CVE-2024-6469MEDIUMplaySMS Template injectionEPSS 0.7%CVE-2025-3689MEDIUMPHPGurukul Men Salon Management System edit-customer-detailed.php sql injectionEPSS 0.7%CVE-2026-4963MEDIUMhuggingface smolagents Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_with code injectionEPSS 0.7%CVE-2024-34448HIGHGhost before 5.82.0 allows CSV Injection during a member CSV export.EPSS 0.7%