Weaknesses of type CWE-74
4,753 resultsInjeção de código
É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.
Example
Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.
How to mitigate
Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.
CVE-2025-4937MEDIUMSourceCodester Apartment Visitor Management System profile.php sql injectionEPSS 0.6%CVE-2025-4874MEDIUMPHPGurukul News Portal Project contactus.php sql injectionEPSS 0.6%CVE-2025-5214MEDIUMKashipara Responsive Online Learing Platform course_detail_user_new.php sql injectionEPSS 0.6%CVE-2025-4861MEDIUMPHPGurukul Beauty Parlour Management System admin-profile.php sql injectionEPSS 0.6%CVE-2025-11944MEDIUMgivanz Vvveb Raw SQL import.php import sql injectionEPSS 0.6%CVE-2025-4880MEDIUMPHPGurukul News Portal aboutus.php sql injectionEPSS 0.6%CVE-2025-4250MEDIUMcode-projects Nero Social Networking Site index.php sql injectionEPSS 0.6%CVE-2025-5332MEDIUM1000 Projects Online Notice Board index.php sql injectionEPSS 0.6%CVE-2025-5205MEDIUM1000 Projects Daily College Class Work Report Book dcwr_entry.php sql injectionEPSS 0.6%CVE-2025-4241MEDIUMPHPGurukul Teacher Subject Allocation Management System search.php sql injectionEPSS 0.6%CVE-2025-5216MEDIUMPHPGurukul Student Record System login.php sql injectionEPSS 0.6%CVE-2025-4226MEDIUMPHPGurukul/Campcodes Cyber Cafe Management System add-computer.php sql injectionEPSS 0.6%CVE-2025-2378MEDIUMPHPGurukul Medical Card Generation System download-medical-cards.php sql injectionEPSS 0.6%CVE-2025-0490MEDIUMFanli2012 native-php-cms article_dodel.php sql injectionEPSS 0.6%CVE-2022-39217MEDIUMImproper Neutralization of Formula Elements in a CSV File in ghas-to-csvEPSS 0.6%CVE-2024-34697HIGHFreescout vulnerable to Stored HTML Injection in Editing Received EmailsEPSS 0.6%CVE-2025-1894MEDIUMPHPGurukul Restaurant Table Booking System search-result.php sql injectionEPSS 0.6%CVE-2024-12489MEDIUMcode-projects Online Class and Exam Scheduling System term.php sql injectionEPSS 0.6%CVE-2025-5400MEDIUMchaitak-gorai Blogbook GET Parameter user.php sql injectionEPSS 0.6%CVE-2024-12488MEDIUMcode-projects Online Class and Exam Scheduling System subject_update.php sql injectionEPSS 0.6%