Weaknesses of type CWE-74

4,743 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-3842MEDIUMpanhainan DS-Java FileUpload.java uploadUserPic.action code injectionEPSS 0.7%CVE-2022-34466—A vulnerability has been identified in Mendix Applications using Mendix 9 (All versions >= V9.11 < V9.15), Mendix Applications using Mendix EPSS 0.7%CVE-2024-10996MEDIUM1000 Projects Bookstore Management System process_category_edit.php sql injectionEPSS 0.7%CVE-2024-10991MEDIUMCodezips Hospital Appointment System editBranchResult.php sql injectionEPSS 0.7%CVE-2024-12229MEDIUMPHPGurukul Complaint Management System complaint-search.php sql injectionEPSS 0.7%CVE-2024-10998MEDIUM1000 Projects Bookstore Management System process_category_add.php sql injectionEPSS 0.7%CVE-2024-12231MEDIUMCodeZips Project Management System index.php sql injectionEPSS 0.7%CVE-2024-12230MEDIUMPHPGurukul Complaint Management System subcategory.php sql injectionEPSS 0.7%CVE-2024-10995MEDIUMCodezips Hospital Appointment System removeDoctorResult.php sql injectionEPSS 0.7%CVE-2024-12188MEDIUM1000 Projects Library Management System stu.php sql injectionEPSS 0.7%CVE-2024-10968MEDIUM1000 Projects Bookstore Management System contact_process.php sql injectionEPSS 0.7%CVE-2024-12228MEDIUMPHPGurukul Complaint Management System user-search.php sql injectionEPSS 0.7%CVE-2026-65646CRITICALImproper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arEPSS 0.7%CVE-2021-37499MEDIUMCRLF vulnerability in Reprise License Manager (RLM) web interface through 14.2BL4 in the password parameter in View License Result function,EPSS 0.7%CVE-2023-0476MEDIUMA LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An autheEPSS 0.7%CVE-2024-11589MEDIUMitsourcecode Tailoring Management System expcatedit.php sql injectionEPSS 0.7%CVE-2021-21580MEDIUMDell EMC iDRAC8 versions prior to 2.80.80.80 & Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a Content spoofing / Text injection, wheEPSS 0.7%CVE-2025-0296MEDIUMcode-projects Online Book Shop booklist.php sql injectionEPSS 0.7%CVE-2025-3563MEDIUMWuzhiCMS Setting index.php set code injectionEPSS 0.7%CVE-2025-0207MEDIUMcode-projects Online Shoe Store login.php sql injectionEPSS 0.7%