Weaknesses of type CWE-74

4,755 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-6958MEDIUMCampcodes Employee Management System edit.php sql injectionEPSS 0.6%CVE-2025-6957MEDIUMCampcodes Employee Management System eprocess.php sql injectionEPSS 0.6%CVE-2024-10946MEDIUMGuangzhou Tuchuang Computer Software Development Interlib Library Cluster Automation Management System SysLib sql injectionEPSS 0.6%CVE-2025-6961MEDIUMCampcodes Employee Management System mark.php sql injectionEPSS 0.6%CVE-2024-10947MEDIUMGuangzhou Tuchuang Computer Software Development Interlib Library Cluster Automation Management System BatchOrder sql injectionEPSS 0.6%CVE-2025-1583MEDIUMPHPGurukul Online Nurse Hiring System search-report-details.php sql injectionEPSS 0.6%CVE-2025-6962MEDIUMCampcodes Employee Management System myprofileup.php sql injectionEPSS 0.6%CVE-2025-1582MEDIUMPHPGurukul Online Nurse Hiring System all-request.php sql injectionEPSS 0.6%CVE-2025-6963MEDIUMCampcodes Employee Management System myprofile.php sql injectionEPSS 0.6%CVE-2025-8378MEDIUMCampcodes Online Hotel Reservation System Login index.php sql injectionEPSS 0.6%CVE-2025-5137MEDIUMDedeCMS Incomplete Fix CVE-2018-9175 sys_verifies.php code injectionEPSS 0.6%CVE-2021-21420HIGHVulnerability in Stripe for Visual Studio Code < 1.7.3EPSS 0.6%CVE-2025-10786MEDIUMCampcodes Grocery Sales and Inventory System ajax.php sql injectionEPSS 0.6%CVE-2024-11245MEDIUMcode-projects Farmacia editar-produto.php sql injectionEPSS 0.6%CVE-2025-10785MEDIUMCampcodes Grocery Sales and Inventory System manage_user.php sql injectionEPSS 0.6%CVE-2024-6933MEDIUMLimeSurvey Survey General Settings updatesurveylocalesettings_generalsettings actionUpdateSurveyLocaleSettingsGeneralSettings sql injectionEPSS 0.6%CVE-2024-12935MEDIUMcode-projects Simple Admin Panel editItemForm.php sql injectionEPSS 0.6%CVE-2024-13093MEDIUMcode-projects Job Recruitment Seeker Profile _call_main_search_ajax.php sql injectionEPSS 0.6%CVE-2024-12936MEDIUMcode-projects Simple Admin Panel catDeleteController.php sql injectionEPSS 0.6%CVE-2024-13092MEDIUMcode-projects Job Recruitment Job Post search_ajax.php sql injectionEPSS 0.6%