Weaknesses of type CWE-74

4,745 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2024-11818MEDIUMPHPGurukul User Registration & Login and User Management System signup.php sql injectionEPSS 0.6%CVE-2024-11819MEDIUM1000 Projects Portfolio Management System MCA forgot_password_process.php sql injectionEPSS 0.6%CVE-2024-11055MEDIUM1000 Projects Beauty Parlour Management System admin-profile.php sql injectionEPSS 0.6%CVE-2024-11057MEDIUMCodezips Hospital Appointment System removeBranchResult.php sql injectionEPSS 0.6%CVE-2025-1200MEDIUMSourceCodester Best Church Management Software slider_crud.php sql injectionEPSS 0.6%CVE-2025-1185MEDIUMpihome-shc PiHome ajax.php sql injectionEPSS 0.6%CVE-2024-28867MEDIUMSwift Prometheus un-sanitized metric name or labels can be used to take over exported metricsEPSS 0.6%CVE-2023-6458HIGHClient side path traversal due to lack of route parameters validationEPSS 0.6%CVE-2025-8471MEDIUMprojectworlds Online Admission System adminlogin.php sql injectionEPSS 0.6%CVE-2025-4714MEDIUMCampcodes Sales and Inventory System reprint.php sql injectionEPSS 0.6%CVE-2024-12791MEDIUMCodezips E-Commerce Site signin.php sql injectionEPSS 0.6%CVE-2025-4812MEDIUMPHPGurukul Human Metapneumovirus Testing Management System profile.php sql injectionEPSS 0.6%CVE-2025-4713MEDIUMCampcodes Sales and Inventory System print.php sql injectionEPSS 0.6%CVE-2025-4712MEDIUMCampcodes Sales and Inventory System account_summary.php sql injectionEPSS 0.6%CVE-2025-4813MEDIUMPHPGurukul Human Metapneumovirus Testing Management System edit-phlebotomist.php sql injectionEPSS 0.6%CVE-2026-55404HIGHyt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link outputEPSS 0.6%CVE-2025-1641MEDIUMBenner ModernaNet GetHorariosDoDia sql injectionEPSS 0.6%CVE-2025-1640MEDIUMBenner ModernaNet JS_CarregaCombo sql injectionEPSS 0.6%CVE-2025-0532MEDIUMCodezips Gym Management System new_submit.php sql injectionEPSS 0.6%CVE-2025-0340MEDIUMcode-projects Cinema Seat Reservation System deleteBooking.php sql injectionEPSS 0.6%