Weaknesses of type CWE-74

4,760 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-2847MEDIUMCodezips Gym Management System over_month.php sql injectionEPSS 0.5%CVE-2025-2735MEDIUMPHPGurukul Old Age Home Management System add-services.php sql injectionEPSS 0.5%CVE-2025-2734MEDIUMPHPGurukul Old Age Home Management System aboutus.php sql injectionEPSS 0.5%CVE-2025-2472MEDIUMPHPGurukul Apartment Visitors Management System Sign In index.php sql injectionEPSS 0.5%CVE-2025-2362MEDIUMPHPGurukul Pre-School Enrollment System contact-us.php sql injectionEPSS 0.5%CVE-2025-2385MEDIUMcode-projects Modern Bag login.php sql injectionEPSS 0.5%CVE-2025-2382MEDIUMPHPGurukul Online Banquet Booking System booking-search.php sql injectionEPSS 0.5%CVE-2025-2372MEDIUMPHPGurukul Human Metapneumovirus Testing Management System Password Recovery Page password-recovery.php sql injectionEPSS 0.5%CVE-2025-2381MEDIUMPHPGurukul Curfew e-Pass Management System search-pass.php sql injectionEPSS 0.5%CVE-2025-2387MEDIUMSourceCodester Online Food Ordering System ajax.php sql injectionEPSS 0.5%CVE-2025-2854MEDIUMcode-projects Payroll Management System update_employee.php sql injectionEPSS 0.5%CVE-2025-2386MEDIUMPHPGurukul Local Services Search Engine Management System serviceman-search.php sql injectionEPSS 0.5%CVE-2025-2380MEDIUMPHPGurukul Apartment Visitors Management System admin-profile.php sql injectionEPSS 0.5%CVE-2025-2379MEDIUMPHPGurukul Apartment Visitors Management System create-pass.php sql injectionEPSS 0.5%CVE-2025-2739MEDIUMPHPGurukul Old Age Home Management System manage-services.php sql injectionEPSS 0.5%CVE-2025-2383MEDIUMPHPGurukul Doctor Appointment Management System search.php sql injectionEPSS 0.5%CVE-2025-6777MEDIUMcode-projects Food Distributor Site process_login.php sql injectionEPSS 0.5%CVE-2026-1422MEDIUMcode-projects Online Examination System Login Page index.php sql injectionEPSS 0.5%CVE-2024-11251MEDIUMerzhongxmu Jeewms AuthInterceptor cgReportController.do sql injectionEPSS 0.5%CVE-2026-32695MEDIUMTraefik has Knative Ingress Rule Injection that Allows Host Restriction BypassEPSS 0.5%