Weaknesses of type CWE-74

4,745 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-4490MEDIUMCampcodes Online Food Ordering System view-ticket-admin.php sql injectionEPSS 0.7%CVE-2026-5797MEDIUMQuiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input FieldsEPSS 0.7%CVE-2026-26002MEDIUMOnDemand susceptible to malicious input when navigating to a directory.EPSS 0.7%CVE-2022-4768MEDIUMDropbox merou SSH Public Key public_key.py add_public_key injectionEPSS 0.7%CVE-2024-10153MEDIUMPHPGurukul Boat Booking System Book a Boat Page book-boat.php sql injectionEPSS 0.7%CVE-2024-12940MEDIUM1000 Projects Attendance Tracking Management System student_action.php sql injectionEPSS 0.7%CVE-2024-5193MEDIUMRitlabs TinyWeb Server Request crlf injectionEPSS 0.7%CVE-2023-4818HIGHPAX A920 device allows to downgrade bootloader due to a bug in its version check. The signature is correctly checked and only bootloader sigEPSS 0.7%CVE-2025-4332MEDIUMPHPGurukul Company Visitor Management System visitor-detail.php sql injectionEPSS 0.7%CVE-2025-5248MEDIUMPHPGurukul Company Visitor Management System bwdates-reports-details.php sql injectionEPSS 0.7%CVE-2025-0803MEDIUMCodezips Gym Management System submit_plan_new.php sql injectionEPSS 0.7%CVE-2023-29389MEDIUMToyota RAV4 2021 vehicles automatically trust messages from other ECUs on a CAN bus, which allows physically proximate attackers to drive a EPSS 0.7%CVE-2025-4546MEDIUM1Panel-dev MaxKB Knowledge Base Module csv injectionEPSS 0.7%CVE-2025-3039MEDIUMcode-projects Payroll Management System add_employee.php sql injectionEPSS 0.7%CVE-2026-2954MEDIUMDromara UJCMS ImportDataController import-channel importChanel injectionEPSS 0.7%CVE-2025-3038MEDIUMcode-projects Payroll Management System view_account.php sql injectionEPSS 0.7%CVE-2024-12976MEDIUMCodeZips Hospital Management System staff.php sql injectionEPSS 0.7%CVE-2024-12792MEDIUMCodezips E-Commerce Site newadmin.php sql injectionEPSS 0.7%CVE-2025-0297MEDIUMcode-projects Online Book Shop detail.php sql injectionEPSS 0.7%CVE-2024-11077MEDIUMcode-projects Job Recruitment index.php sql injectionEPSS 0.7%