Weaknesses of type CWE-74

4,754 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2024-12489MEDIUMcode-projects Online Class and Exam Scheduling System term.php sql injectionEPSS 0.6%CVE-2025-5400MEDIUMchaitak-gorai Blogbook GET Parameter user.php sql injectionEPSS 0.6%CVE-2024-12485MEDIUMcode-projects Online Class and Exam Scheduling System department.php sql injectionEPSS 0.6%CVE-2026-20272CRITICALCisco IOS XE Software Security Hardening ReleaseEPSS 0.6%CVE-2025-1611MEDIUMShopXO Template ThemeAdminService.php injectionEPSS 0.6%CVE-2025-4022MEDIUMweb-arena-x webarena evaluators.py HTMLContentEvaluator code injectionEPSS 0.6%CVE-2026-3759MEDIUMprojectworlds Online Art Gallery Shop adminHome.php sql injectionEPSS 0.6%CVE-2024-11074MEDIUMitsourcecode Tailoring Management System incadd.php sql injectionEPSS 0.6%CVE-2026-5257MEDIUMcode-projects Simple Laundry System Parameter delstaffinfo.php sql injectionEPSS 0.6%CVE-2026-5019MEDIUMcode-projects Simple Food Order System Parameter all-orders.php sql injectionEPSS 0.6%CVE-2026-4784MEDIUMcode-projects Simple Laundry System Parameter checkcheckout.php sql injectionEPSS 0.6%CVE-2026-5368MEDIUMprojectworlds Car Rental Project Parameter login.php sql injectionEPSS 0.6%CVE-2026-3406MEDIUMprojectworlds Online Art Gallery Shop Registration registration.php sql injectionEPSS 0.6%CVE-2026-3705MEDIUMcode-projects Simple Flight Ticket Booking System Adminsearch.php sql injectionEPSS 0.6%CVE-2026-3730MEDIUMitsourcecode Free Hotel Reservation System index.php sql injectionEPSS 0.6%CVE-2026-3411MEDIUMitsourcecode University Management System admin_single_student_update.php sql injectionEPSS 0.6%CVE-2026-5017MEDIUMcode-projects Simple Food Order System Parameter all-tickets.php sql injectionEPSS 0.6%CVE-2026-5256MEDIUMcode-projects Simple Laundry System Parameter modify.php sql injectionEPSS 0.6%CVE-2026-5018MEDIUMcode-projects Simple Food Order System Parameter register-router.php sql injectionEPSS 0.6%CVE-2026-3708MEDIUMcode-projects Simple Flight Ticket Booking System login.php sql injectionEPSS 0.6%