Weaknesses of type CWE-74

4,758 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-1820MEDIUMzj1983 zz ZworkflowAction.java getOaWid sql injectionEPSS 0.5%CVE-2025-0874MEDIUMcode-projects Simple Plugins Car Rental Management approve.php sql injectionEPSS 0.5%CVE-2025-0336MEDIUMCodezips Project Management System teacher.php sql injectionEPSS 0.5%CVE-2025-1832MEDIUMzj1983 zz ZroleAction.java getUserList sql injectionEPSS 0.5%CVE-2024-12947MEDIUMCodezips Hospital Management System invo.php sql injectionEPSS 0.5%CVE-2025-1380MEDIUMCodezips Gym Management System del_plan.php sql injectionEPSS 0.5%CVE-2024-13014MEDIUMPHPGurukul Maid Hiring Management System search-maid.php sql injectionEPSS 0.5%CVE-2025-1379MEDIUMcode-projects Real Estate Property Management System CustomerReport.php sql injectionEPSS 0.5%CVE-2025-4485MEDIUMitsourcecode Gym Management System ajax.php sql injectionEPSS 0.5%CVE-2025-8173MEDIUM1000 Projects ABC Courier Management System Add_reciver.php sql injectionEPSS 0.5%CVE-2025-1168MEDIUMSourceCodester Contact Manager with Export to VCF delete-contact.php sql injectionEPSS 0.5%CVE-2026-0865MEDIUMwsgiref.headers.Headers allows header newline injectionEPSS 0.5%CVE-2024-43782HIGHopenedx-translations's Atlas translations for Open edX missing validationEPSS 0.5%CVE-2024-11051MEDIUMAMTT Hotel Broadband Operation System online_status.php sql injectionEPSS 0.5%CVE-2026-76760MEDIUMchenhg5 cc-connect webhook.go authenticate code injectionEPSS 0.5%CVE-2024-5184HIGHPrompt Injection in EmailGPTEPSS 0.5%CVE-2026-14722MEDIUMtiddly-gittly TidGi-Desktop Git Repository Import loadWikiTiddlersWithSubWikis.ts code injectionEPSS 0.5%CVE-2026-33833HIGHAzure Machine Learning Notebook Spoofing VulnerabilityEPSS 0.5%CVE-2025-9699MEDIUMSourceCodester Online Polling System Code checklogin.php sql injectionEPSS 0.5%CVE-2026-14749MEDIUMmjperpinosa stumasy calculate.php eval code injectionEPSS 0.5%