Weaknesses of type CWE-74

4,765 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-2065MEDIUMprojectworlds Life Insurance Management System editAgent.php sql injectionEPSS 0.5%CVE-2025-2642MEDIUMPHPGurukul Art Gallery Management System edit-art-product-detail.php sql injectionEPSS 0.5%CVE-2025-2684MEDIUMPHPGurukul Bank Locker Management System search-report-details.php sql injectionEPSS 0.5%CVE-2025-2066MEDIUMprojectworlds Life Insurance Management System updateAgent.php sql injectionEPSS 0.5%CVE-2025-2675MEDIUMPHPGurukul Bank Locker Management System add-lockertype.php sql injectionEPSS 0.5%CVE-2025-2657MEDIUMprojectworlds Apartment Visitors Management System front.php sql injectionEPSS 0.5%CVE-2025-2067MEDIUMprojectworlds Life Insurance Management System search.php sql injectionEPSS 0.5%CVE-2025-2064MEDIUMprojectworlds Life Insurance Management System deletePayment.php sql injectionEPSS 0.5%CVE-2025-2678MEDIUMPHPGurukul Bank Locker Management System changeimage1.php sql injectionEPSS 0.5%CVE-2025-2663MEDIUMPHPGurukul Bank Locker Management System search-locker-details.php sql injectionEPSS 0.5%CVE-2025-1227MEDIUMywoa AddressDao.xml selectList sql injectionEPSS 0.5%CVE-2025-2033MEDIUMcode-projects Blood Bank Management System view_donor.php sql injectionEPSS 0.5%CVE-2025-2088MEDIUMPHPGurukul Pre-School Enrollment System profile.php sql injectionEPSS 0.5%CVE-2026-19351MEDIUMdresende node-sql-query Request Parameter Select.js SelectQuery.build sql injectionEPSS 0.5%CVE-2025-3796MEDIUMPHPGurukul Men Salon Management System contact-us.php sql injectionEPSS 0.5%CVE-2025-3817MEDIUMSourceCodester Online Eyewear Shop Master.php sql injectionEPSS 0.5%CVE-2026-20231CRITICALCisco Secure Workload Software Security Hardening Release August 2026 - Improper Neutralization of Special Elements VulnerabilitiesEPSS 0.5%CVE-2025-4060MEDIUMPHPGurukul Notice Board System category.php sql injectionEPSS 0.5%CVE-2025-3968MEDIUMcodeprojects News Publishing Site Dashboard api.php sql injectionEPSS 0.5%CVE-2024-12895MEDIUMTreasureHuntGame TreasureHunt checkflag.php console_log sql injectionEPSS 0.5%