Weaknesses of type CWE-74
4,755 resultsInjeção de código
É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.
Example
Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.
How to mitigate
Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.
CVE-2025-4027MEDIUMPHPGurukul Old Age Home Management System rules.php sql injectionEPSS 0.6%CVE-2025-4108MEDIUMPHPGurukul Student Record System add-subject.php sql injectionEPSS 0.6%CVE-2025-3311MEDIUMPHPGurukul Men Salon Management System about-us.php sql injectionEPSS 0.6%CVE-2025-3315MEDIUMSourceCodester Apartment Visitor Management System view-report.php sql injectionEPSS 0.6%CVE-2025-4026MEDIUMPHPGurukul Nipah Virus Testing Management System profile.php sql injectionEPSS 0.6%CVE-2025-3323MEDIUMgodcheese/code-projects Nimrod ViewMenuCategoryRestController.java searchAllByName sql injectionEPSS 0.6%CVE-2025-3338MEDIUMcodeprojects Online Restaurant Management System user_save.php sql injectionEPSS 0.6%CVE-2025-4034MEDIUMprojectworlds Online Examination System inser_doc_process.php sql injectionEPSS 0.6%CVE-2025-4023MEDIUMitsourcecode Placement Management System add_company.php sql injectionEPSS 0.6%CVE-2025-3306MEDIUMcode-projects Blood Bank Management System don.php sql injectionEPSS 0.6%CVE-2025-13786MEDIUMtaosir WTCMS index.php fetch code injectionEPSS 0.6%CVE-2025-0168MEDIUMcode-projects Job Recruitment _feedback_system.php sql injectionEPSS 0.6%CVE-2025-4112MEDIUMPHPGurukul Student Record System add-course.php sql injectionEPSS 0.6%CVE-2025-4025MEDIUMitsourcecode Placement Management System registration.php sql injectionEPSS 0.6%CVE-2025-3309MEDIUMcode-projects Blood Bank Management System campsdetails.php sql injectionEPSS 0.6%CVE-2025-9492MEDIUMCampcodes Online Water Billing System addclient1.php sql injectionEPSS 0.6%CVE-2025-5583MEDIUMCodeAstro Real Estate Management System register.php sql injectionEPSS 0.6%CVE-2025-5639MEDIUMPHPGurukul Notice Board System forgot-password.php sql injectionEPSS 0.6%CVE-2025-4492MEDIUMCampcodes Online Food Ordering System ticket-message.php sql injectionEPSS 0.6%CVE-2025-5626MEDIUMCampcodes Online Teacher Record Management System edit-subjects-detail.php sql injectionEPSS 0.6%