Weaknesses of type CWE-74

4,766 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-8239MEDIUMcode-projects Exam Form Submission admin sql injectionEPSS 0.5%CVE-2025-14620MEDIUMcode-projects Student File Management System login_query.php sql injectionEPSS 0.5%CVE-2025-8241MEDIUM1000 Projects ABC Courier Management System report.php sql injectionEPSS 0.5%CVE-2025-14619MEDIUMcode-projects Student File Management System login_query.php sql injectionEPSS 0.5%CVE-2025-8236MEDIUMcode-projects Online Ordering System edit_product.php sql injectionEPSS 0.5%CVE-2025-8237MEDIUMcode-projects Exam Form Submission update_s1.php sql injectionEPSS 0.5%CVE-2025-0344MEDIUMleiyuxi cy-fast listData sql injectionEPSS 0.5%CVE-2025-7929MEDIUMcode-projects Church Donation System edit_Members.php sql injectionEPSS 0.5%CVE-2025-8240MEDIUMcode-projects Exam Form Submission dashboard.php sql injectionEPSS 0.5%CVE-2025-1854MEDIUMCodezips Gym Management System del_member.php sql injectionEPSS 0.5%CVE-2025-1191MEDIUMSourceCodester Multi Restaurant Table Reservation System approve-reject.php sql injectionEPSS 0.5%CVE-2025-1184MEDIUMpihome-shc PiHome ajax.php sql injectionEPSS 0.5%CVE-2024-2769MEDIUMCampcodes Complete Online Beauty Parlor Management System admin-profile.php sql injectionEPSS 0.5%CVE-2025-1855MEDIUMPHPGurukul Online Shopping Portal product-details.php sql injectionEPSS 0.5%CVE-2024-13079MEDIUMPHPGurukul Land Record System property-details.php sql injectionEPSS 0.5%CVE-2025-0232MEDIUMCodezips Blood Bank Management System successadmin.php sql injectionEPSS 0.5%CVE-2026-9353MEDIUMNousResearch hermes-agent Skills Guard Multi-Word Prompt skills_guard.py injectionEPSS 0.5%CVE-2025-7164MEDIUMPHPGurukul/Campcodes Cyber Cafe Management System index.php sql injectionEPSS 0.5%CVE-2026-9422MEDIUMKLiK SocialMediaWebsite HTTP POST Request Parameter injectionEPSS 0.5%CVE-2025-7165MEDIUMPHPGurukul/Campcodes Cyber Cafe Management System forgot-password.php sql injectionEPSS 0.5%