Weaknesses of type CWE-74

4,746 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-7173MEDIUMcode-projects Library System add-student.php sql injectionEPSS 0.6%CVE-2025-7933MEDIUMCampcodes Sales and Inventory System Setting settings_update.php sql injectionEPSS 0.6%CVE-2026-16759MEDIUMTutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST ParametersEPSS 0.6%CVE-2025-1812MEDIUMzj1983 zz SuperZ.java GetUserOrg sql injectionEPSS 0.6%CVE-2025-0210MEDIUMCampcodes School Faculty Scheduling System ajax.php sql injectionEPSS 0.6%CVE-2024-12969MEDIUMcode-projects Hospital Management System Login index.php sql injectionEPSS 0.6%CVE-2025-1850MEDIUMCodezips College Management System university.php sql injectionEPSS 0.6%CVE-2025-0842MEDIUMneedyamin Library Card System Login admin.php sql injectionEPSS 0.6%CVE-2025-0533MEDIUM1000 Projects Campaign Management System Platform for Women sc_login.php sql injectionEPSS 0.6%CVE-2025-0843MEDIUMneedyamin Library Card System Admin Panel admindashboard.php sql injectionEPSS 0.6%CVE-2025-1856MEDIUMCodezips Gym Management System gen_invoice.php sql injectionEPSS 0.6%CVE-2025-1858MEDIUMCodezips Online Shopping Website success.php sql injectionEPSS 0.6%CVE-2025-0534MEDIUM1000 Projects Campaign Management System Platform for Women loginnew.php sql injectionEPSS 0.6%CVE-2024-41122HIGHCustom environment variables allow to alter execution flow of plugins in WoodpeckerEPSS 0.6%CVE-2023-30609MEDIUMmatrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlightingEPSS 0.6%CVE-2024-20429MEDIUMA vulnerability in the web-based management interface of Cisco AsyncOS for Secure Email Gateway could allow an authenticated, remote attackeEPSS 0.6%CVE-2025-4866MEDIUMweibocom rill-flow Management Console code injectionEPSS 0.6%CVE-2024-27708CRITICALIframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary EPSS 0.6%CVE-2025-4782MEDIUMSourceCodester/oretnom23 Stock Management System view_receiving sql injectionEPSS 0.6%CVE-2024-12962MEDIUMcode-projects Job Recruitment _all_edits.php sql injectionEPSS 0.6%