Weaknesses of type CWE-74

4,760 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-12618HIGHSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.5%CVE-2025-0173MEDIUMSourceCodester Online Eyewear Shop view_order.php sql injectionEPSS 0.5%CVE-2026-3287MEDIUMyoulaitech youlai-mall App-side Product Pagination Endpoint SpuController.java listPagedSpuForApp sql injectionEPSS 0.5%CVE-2024-11213MEDIUMSourceCodester Best Employee Management System edit_role.php sql injectionEPSS 0.5%CVE-2025-5119MEDIUMEmlog Pro api_controller.php sql injectionEPSS 0.5%CVE-2024-12937MEDIUMcode-projects Simple Admin Panel addVariationController.php sql injectionEPSS 0.5%CVE-2024-12931MEDIUMcode-projects Simple Admin Panel addCatController.php sql injectionEPSS 0.5%CVE-2025-1465LOWlmxcms Maintenance db.inc.php code injectionEPSS 0.5%CVE-2025-27107HIGHIntegrated Scripting vulnerable to arbitrary code execution via Java reflectionEPSS 0.5%CVE-2025-9694MEDIUMCampcodes Advanced Online Voting System login.php sql injectionEPSS 0.5%CVE-2025-1216MEDIUMywoa OaNoticeMapper.xml selectNoticeList sql injectionEPSS 0.5%CVE-2025-4487MEDIUMitsourcecode Gym Management System ajax.php sql injectionEPSS 0.5%CVE-2025-4484MEDIUMitsourcecode Gym Management System ajax.php sql injectionEPSS 0.5%CVE-2025-4486MEDIUMitsourcecode Gym Management System ajax.php sql injectionEPSS 0.5%CVE-2025-4488MEDIUMitsourcecode Gym Management System ajax.php sql injectionEPSS 0.5%CVE-2025-5913MEDIUMPHPGurukul Vehicle Record Management System search-vehicle.php sql injectionEPSS 0.5%CVE-2025-4483MEDIUMitsourcecode Gym Management System view_pdetails.php sql injectionEPSS 0.5%CVE-2025-4481MEDIUMSourceCodester Apartment Visitor Management System search-result.php sql injectionEPSS 0.5%CVE-2025-4482MEDIUMProject Worlds Student Project Allocation System forgot_password_sql.php sql injectionEPSS 0.5%CVE-2025-2847MEDIUMCodezips Gym Management System over_month.php sql injectionEPSS 0.5%