Weaknesses of type CWE-74

4,765 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-4550MEDIUMPHPGurukul Apartment Visitors Management System pass-details.php sql injectionEPSS 0.5%CVE-2025-4548MEDIUMCampcodes Online Food Ordering System router.php sql injectionEPSS 0.5%CVE-2025-9468MEDIUMitsourcecode Apartment Management System add_bill.php sql injectionEPSS 0.5%CVE-2025-3134MEDIUMcode-projects Payroll Management System add_overtime.php sql injectionEPSS 0.5%CVE-2025-9660MEDIUMSourceCodester Bakeshop Online Ordering System passwordrecover.php sql injectionEPSS 0.5%CVE-2025-10482MEDIUMSourceCodester Online Student File Management System index.php sql injectionEPSS 0.5%CVE-2025-3142MEDIUMSourceCodester Apartment Visitor Management System add-apartment.php sql injectionEPSS 0.5%CVE-2025-9470MEDIUMitsourcecode Apartment Management System add_m_committee.php sql injectionEPSS 0.5%CVE-2025-8408MEDIUMcode-projects Vehicle Management filter1.php sql injectionEPSS 0.5%CVE-2025-10118MEDIUMitsourcecode E-Logbook with Health Monitoring System for COVID-19 login.php sql injectionEPSS 0.5%CVE-2025-3697MEDIUMSourceCodester Web-based Pharmacy Product Management System edit-product.php sql injectionEPSS 0.5%CVE-2024-11101MEDIUM1000 Projects Beauty Parlour Management System search-invoices.php sql injectionEPSS 0.5%CVE-2025-3267MEDIUMqinguoyi TinyWebServer http_conn.cpp sql injectionEPSS 0.5%CVE-2025-4503MEDIUMCampcodes Sales and Inventory System customer_update.php sql injectionEPSS 0.5%CVE-2025-9767MEDIUMitsourcecode Sports Management System sporttype.php sql injectionEPSS 0.5%CVE-2025-8375MEDIUMcode-projects Vehicle Management addvehicle.php sql injectionEPSS 0.5%CVE-2025-9471MEDIUMitsourcecode Apartment Management System add_maintenance_cost.php sql injectionEPSS 0.5%CVE-2025-3696MEDIUMSourceCodester Web-based Pharmacy Product Management System search_stock. php sql injectionEPSS 0.5%CVE-2025-4549MEDIUMCampcodes Online Food Ordering System register-router.php sql injectionEPSS 0.5%CVE-2025-3348MEDIUMcode-projects Patient Record Management System edit_dpatient.php sql injectionEPSS 0.5%