Weaknesses of type CWE-74

4,766 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-0846MEDIUM1000 Projects Employee Task Management System AdminLogin.php sql injectionEPSS 0.5%CVE-2026-13500MEDIUMantlr ANTLR4 Grammar Action Block OutputFile.java code injectionEPSS 0.5%CVE-2026-6603MEDIUMmodelscope agentscope _python.py execute_shell_command code injectionEPSS 0.5%CVE-2026-94004MEDIUMDedeCMS mytag_js.php code injectionEPSS 0.5%CVE-2026-85137MEDIUMSeaCMS Locoy Collector seacms_locoy_news.php parseIf code injectionEPSS 0.5%CVE-2026-9366MEDIUMNousResearch hermes-agent prompt_builder.py _scan_context_content injectionEPSS 0.5%CVE-2025-5610MEDIUMCodeAstro Real Estate Management System submitpropertydelete.php sql injectionEPSS 0.5%CVE-2025-5582MEDIUMCodeAstro Real Estate Management System profile.php sql injectionEPSS 0.5%CVE-2026-3292MEDIUMjizhiCMS Batch Model.php findAll sql injectionEPSS 0.5%CVE-2026-8724MEDIUMDataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injectionEPSS 0.5%CVE-2025-4311MEDIUMitsourcecode Content Management System update_main_topic_img.php sql injectionEPSS 0.5%CVE-2025-4758MEDIUMPHPGurukul Beauty Parlour Management System contact.php sql injectionEPSS 0.5%CVE-2025-5002MEDIUMSourceCodester Client Database Management System user_proposal_update_order.php sql injectionEPSS 0.5%CVE-2025-4934MEDIUMPHPGurukul User Registration & Login and User Management System edit-profile.php sql injectionEPSS 0.5%CVE-2025-4817MEDIUMSourcecodester Doctor's Appointment System GET Parameter delete-appointment.php sql injectionEPSS 0.5%CVE-2025-4359MEDIUMitsourcecode Gym Management System ajax.php sql injectionEPSS 0.5%CVE-2025-4746MEDIUMCampcodes Sales and Inventory System purchase_delete.php sql injectionEPSS 0.5%CVE-2025-4709MEDIUMCampcodes Sales and Inventory System transaction_del.php sql injectionEPSS 0.5%CVE-2025-4706MEDIUMprojectworlds Online Examination System Procedure3b_yearwiseVisit.php sql injectionEPSS 0.5%CVE-2025-4363MEDIUMitsourcecode Gym Management System ajax.php sql injectionEPSS 0.5%