Weaknesses of type CWE-74

4,743 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-4785MEDIUMPHPGurukul Daily Expense Tracker System user-profile.php sql injectionEPSS 0.7%CVE-2026-93967MEDIUMaiyiyi121 SxDevOps Command services.py generate_host_task command injectionEPSS 0.7%CVE-2026-5584MEDIUMFosowl agenticSeek query Endpoint PyInterpreter.py PyInterpreter.execute code injectionEPSS 0.7%CVE-2024-11244MEDIUMcode-projects Farmacia editar-cliente.php sql injectionEPSS 0.7%CVE-2025-4793MEDIUMPHPGurukul Online Course Registration edit-student-profile.php sql injectionEPSS 0.7%CVE-2023-7100MEDIUMPHPGurukul Restaurant Table Booking System bwdates-report-details.php sql injectionEPSS 0.7%CVE-2024-12492MEDIUMcode-projects Farmacia visualizar-usuario.php sql injectionEPSS 0.7%CVE-2024-11250MEDIUMcode-projects Inventory Management editProduct.php sql injectionEPSS 0.7%CVE-2026-6110MEDIUMFoundationAgents MetaGPT Tree-of-Thought Solver tot.py generate_thoughts code injectionEPSS 0.7%CVE-2024-13007MEDIUMCodezips Event Management System contact.php sql injectionEPSS 0.7%CVE-2026-5970MEDIUMFoundationAgents MetaGPT HumanEvalBenchmark/MBPPBenchmark check_solution code injectionEPSS 0.7%CVE-2024-12900MEDIUMFoxCMS Configuration File installdb.php code injectionEPSS 0.7%CVE-2026-71320HIGHNuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island PropsEPSS 0.7%CVE-2025-0527MEDIUMcode-projects Admission Management System signupconfirm.php sql injectionEPSS 0.7%CVE-2024-11256MEDIUM1000 Projects Portfolio Management System MCA login.php sql injectionEPSS 0.7%CVE-2024-52004HIGHRemote code execution vulnerabilities in MediaCMSEPSS 0.7%CVE-2024-13006MEDIUM1000 Projects Human Resource Management System employeeview.php sql injectionEPSS 0.7%CVE-2024-41111HIGHBishopFox Sliver Authenticated Remote Code ExecutionEPSS 0.7%CVE-2022-46873HIGHBecause Firefox did not implement the <code>unsafe-hashes</code> CSP directive, an attacker who was able to inject markup into a page otherwEPSS 0.7%CVE-2025-0347MEDIUMcode-projects Admission Management System Login index.php sql injectionEPSS 0.7%