Weaknesses of type CWE-74

4,745 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2024-11631MEDIUMitsourcecode Tailoring Management System expedit.php sql injectionEPSS 0.7%CVE-2024-40137MEDIUMDolibarr ERP CRM before 19.0.2-php8.2 was discovered to contain a remote code execution (RCE) vulnerability via the Computed field parameterEPSS 0.7%CVE-2026-30932HIGHFroxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones APIEPSS 0.7%CVE-2025-3164MEDIUMTencent Music Entertainment SuperSonic H2 Database Connection testConnect code injectionEPSS 0.7%CVE-2024-46983CRITICALRemote Command Execution(RCE) Vulnerbility in sofa-hessianEPSS 0.7%CVE-2025-0294MEDIUMSourceCodester Home Clean Services Management System process.php sql injectionEPSS 0.7%CVE-2026-49097MEDIUMApache Camel: Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to redirect outgoing IRC messages to arbitrary channels or usersEPSS 0.7%CVE-2025-1173MEDIUM1000 Projects Bookstore Management System process_users_del.php sql injectionEPSS 0.7%CVE-2024-50572HIGHA vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM EPSS 0.7%CVE-2023-7096MEDIUMcode-projects Faculty Management System crud.php sql injectionEPSS 0.7%CVE-2026-15497MEDIUMSonicCloudOrg sonic-agent JWT Authentication Filter ExchangeController.java code injectionEPSS 0.7%CVE-2025-3401MEDIUMESAFENET CDG getLimitIPList.jsp sql injectionEPSS 0.7%CVE-2026-25586CRITICALSandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype PollutionEPSS 0.7%CVE-2025-3400MEDIUMESAFENET CDG UnChkMailApplication.jsp sql injectionEPSS 0.7%CVE-2025-3399MEDIUMESAFENET CDG updateNotice.jsp sql injectionEPSS 0.7%CVE-2026-90999CRITICALSentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environmentEPSS 0.7%CVE-2025-4491MEDIUMCampcodes Online Food Ordering System ticket-status.php sql injectionEPSS 0.7%CVE-2026-4998MEDIUMSinaptik AI PandasAI Chat Message code_executor.py CodeExecutor.execute code injectionEPSS 0.7%CVE-2025-4489MEDIUMCampcodes Online Food Ordering System user-router.php sql injectionEPSS 0.7%CVE-2025-4490MEDIUMCampcodes Online Food Ordering System view-ticket-admin.php sql injectionEPSS 0.7%