Weaknesses of type CWE-74

4,765 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-3267MEDIUMqinguoyi TinyWebServer http_conn.cpp sql injectionEPSS 0.5%CVE-2024-11101MEDIUM1000 Projects Beauty Parlour Management System search-invoices.php sql injectionEPSS 0.5%CVE-2025-6484MEDIUMcode-projects Online Shopping Store action.php sql injectionEPSS 0.5%CVE-2025-10448MEDIUMCampcodes Online Job Finder System index.php sql injectionEPSS 0.5%CVE-2025-4550MEDIUMPHPGurukul Apartment Visitors Management System pass-details.php sql injectionEPSS 0.5%CVE-2025-4072MEDIUMPHPGurukul Online Nurse Hiring System edit-nurse.php sql injectionEPSS 0.5%CVE-2025-9469MEDIUMitsourcecode Apartment Management System add_fund.php sql injectionEPSS 0.5%CVE-2025-9767MEDIUMitsourcecode Sports Management System sporttype.php sql injectionEPSS 0.5%CVE-2025-3696MEDIUMSourceCodester Web-based Pharmacy Product Management System search_stock. php sql injectionEPSS 0.5%CVE-2025-8431MEDIUMPHPGurukul Boat Booking System add-boat.php sql injectionEPSS 0.5%CVE-2025-1167MEDIUMMayuri K Employee Management System Update_User.php sql injectionEPSS 0.5%CVE-2026-24002CRITICALpyodide sandbox option is insecureEPSS 0.5%CVE-2025-5778MEDIUM1000 Projects ABC Courier Management System admin sql injectionEPSS 0.5%CVE-2024-11058MEDIUMCodeAstro Real Estate Management System About Us Page aboutedit.php sql injectionEPSS 0.5%CVE-2023-52081MEDIUMewen-lbh/ffcss late-Unicode normalization vulnerabilityEPSS 0.5%CVE-2025-3684MEDIUMXianqi Kindergarten Management System Child Management stu_list.php sql injectionEPSS 0.5%CVE-2023-39655CRITICALA host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0. By sending a specially crafted host EPSS 0.5%CVE-2025-3797MEDIUMSeaCMS admin_topic.php sql injectionEPSS 0.5%CVE-2025-7894MEDIUMOnyx Chat Interface a3_generate_simple_sql.py generate_simple_sql sql injectionEPSS 0.5%CVE-2025-8441MEDIUMcode-projects Online Medicine Guide pharsignup.php sql injectionEPSS 0.5%