Weaknesses of type CWE-74

4,746 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2024-12962MEDIUMcode-projects Job Recruitment _all_edits.php sql injectionEPSS 0.6%CVE-2024-12967MEDIUMcode-projects Job Recruitment _all_edits.php fln_update sql injectionEPSS 0.6%CVE-2024-9324MEDIUMIntelbras InControl Relatório de Operadores Page operador code injectionEPSS 0.6%CVE-2024-12965MEDIUM1000 Projects Portfolio Management System MCA update_ex_detail.php sql injectionEPSS 0.6%CVE-2024-12968MEDIUMcode-projects Job Recruitment _all_edits.php edit_jobpost sql injectionEPSS 0.6%CVE-2024-12966MEDIUMcode-projects Job Recruitment _all_edits.php cn_update sql injectionEPSS 0.6%CVE-2025-4808MEDIUMPHPGurukul Park Ticketing Management System add-normal-ticket.php sql injectionEPSS 0.6%CVE-2026-49098MEDIUMApache Camel: Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter, allowing an HTTP client to redirect Kafka messages to an arbitrary topicEPSS 0.6%CVE-2025-5574MEDIUMPHPGurukul Dairy Farm Shop Management System add-company.php sql injectionEPSS 0.6%CVE-2025-4781MEDIUMPHPGurukul Park Ticketing Management System forgot-password.php sql injectionEPSS 0.6%CVE-2025-6160MEDIUMSourceCodester Client Database Management System user_customer_create_order.php sql injectionEPSS 0.6%CVE-2023-26919HIGHdelight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape. When allowExitFunctions is set to false, the loadWithNewGlobal funcEPSS 0.6%CVE-2024-12899MEDIUM1000 Projects Attendance Tracking Management System course_action.php sql injectionEPSS 0.6%CVE-2025-0333MEDIUMleiyuxi cy-fast listData sql injectionEPSS 0.6%CVE-2025-2391MEDIUMcode-projects Blood Bank Management System Admin Login Page admin_login.php sql injectionEPSS 0.6%CVE-2026-3152MEDIUMitsourcecode College Management System teacher-salary.php sql injectionEPSS 0.6%CVE-2025-1959MEDIUMCodezips Gym Management System change_s_pwd.php sql injectionEPSS 0.6%CVE-2024-11121MEDIUM上海灵当信息科技有限公司 Lingdang CRM index.php sql injectionEPSS 0.6%CVE-2026-3153MEDIUMitsourcecode Document Management System register.php sql injectionEPSS 0.6%CVE-2026-3148MEDIUMSourceCodester Simple and Nice Shopping Cart Script signup.php sql injectionEPSS 0.6%