Weaknesses of type CWE-74
4,755 resultsInjeção de código
É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.
Example
Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.
How to mitigate
Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.
CVE-2025-10809MEDIUMCampcodes Online Learning Management System department.php sql injectionEPSS 0.6%CVE-2024-13039MEDIUMcode-projects Simple Chat System add_user.php sql injectionEPSS 0.6%CVE-2024-12480MEDIUMcjbi wetech-cms TopicDao.java searchTopic sql injectionEPSS 0.6%CVE-2025-3195MEDIUMitsourcecode Online Blood Bank Management System bbms.php sql injectionEPSS 0.6%CVE-2025-3187MEDIUMPHPGurukul e-Diary Management System login.php sql injectionEPSS 0.6%CVE-2026-1132MEDIUMYonyou KSOA HTTP GET Parameter edit_folder.jsp sql injectionEPSS 0.6%CVE-2026-1443MEDIUMcode-projects Online Music Site AdminDeleteUser.php sql injectionEPSS 0.6%CVE-2025-3006MEDIUMPHPGurukul e-Diary Management System edit-category.php sql injectionEPSS 0.6%CVE-2025-3137MEDIUMPHPGurukul Online Security Guards Hiring System changeimage.php sql injectionEPSS 0.6%CVE-2025-4153MEDIUMPHPGurukul Park Ticketing Management System profile.php sql injectionEPSS 0.6%CVE-2026-14249HIGHRequest a Quote Form Plugin <= 2.5.5 - Unauthenticated Code Injection via 'path' ParameterEPSS 0.6%CVE-2025-3240MEDIUMPHPGurukul Online Fire Reporting System search.php sql injectionEPSS 0.6%CVE-2025-3146MEDIUMPHPGurukul Bus Pass Management System view-pass-detail.php sql injectionEPSS 0.6%CVE-2025-4164MEDIUMPHPGurukul Employee Record Management System changepassword.php sql injectionEPSS 0.6%CVE-2025-3173MEDIUMProject Worlds Online Lawyer Management System save_booking.php sql injectionEPSS 0.6%CVE-2025-3819MEDIUMPHPGurukul Men Salon Management System search-appointment.php sql injectionEPSS 0.6%CVE-2025-3217MEDIUMPHPGurukul e-Diary Management System registration.php sql injectionEPSS 0.6%CVE-2025-3370MEDIUMPHPGurukul Men Salon Management System admin-profile.php sql injectionEPSS 0.6%CVE-2025-3343MEDIUMcodeprojects Online Restaurant Management System reservation_update.php sql injectionEPSS 0.6%CVE-2025-3213MEDIUMPHPGurukul e-Diary Management System view-note.php sql injectionEPSS 0.6%