Weaknesses of type CWE-74
4,747 resultsInjeção de código
É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.
Example
Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.
How to mitigate
Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.
CVE-2025-2391MEDIUMcode-projects Blood Bank Management System Admin Login Page admin_login.php sql injectionEPSS 0.6%CVE-2024-11121MEDIUM上海灵当信息科技有限公司 Lingdang CRM index.php sql injectionEPSS 0.6%CVE-2026-3164MEDIUMitsourcecode News Portal Project contactus.php sql injectionEPSS 0.6%CVE-2026-3148MEDIUMSourceCodester Simple and Nice Shopping Cart Script signup.php sql injectionEPSS 0.6%CVE-2025-0333MEDIUMleiyuxi cy-fast listData sql injectionEPSS 0.6%CVE-2026-3153MEDIUMitsourcecode Document Management System register.php sql injectionEPSS 0.6%CVE-2025-0793MEDIUMESAFENET CDG todoDetail.jsp sql injectionEPSS 0.6%CVE-2022-23068MEDIUMToolJet - HTML Injection in Invite New UserEPSS 0.6%CVE-2025-0204MEDIUMcode-projects Online Shoe Store details.php sql injectionEPSS 0.6%CVE-2025-0203MEDIUMcode-projects Student Management System DbFunction.php showSubject1 sql injectionEPSS 0.6%CVE-2026-27148HIGHStorybook Dev Server Vulnerable to WebSocket HijackingEPSS 0.6%CVE-2025-5128MEDIUMScriptAndTools Real-Estate-website-in-PHP Admin Login Panel admin sql injectionEPSS 0.6%CVE-2024-11099MEDIUMcode-projects Job Recruitment login.php sql injectionEPSS 0.6%CVE-2024-11100MEDIUM1000 Projects Beauty Parlour Management System index.php sql injectionEPSS 0.6%CVE-2024-10791MEDIUMCodezips Hospital Appointment System doctorAction.php sql injectionEPSS 0.6%CVE-2024-12187MEDIUM1000 Projects Library Management System showbook.php sql injectionEPSS 0.6%CVE-2024-28192MEDIUMNoSQL Injection Leading to Authentication Bypass in your_spotifyEPSS 0.6%CVE-2025-3184MEDIUMprojectworlds Online Doctor Appointment Booking System profile.php sql injectionEPSS 0.6%CVE-2025-3183MEDIUMprojectworlds Online Doctor Appointment Booking System patientupdateprofile.php sql injectionEPSS 0.6%CVE-2025-3170MEDIUMProject Worlds Online Lawyer Management System admin_user.php sql injectionEPSS 0.6%