Weaknesses of type CWE-74

4,766 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-5008MEDIUMprojectworlds Online Time Table Generator add_teacher.php sql injectionEPSS 0.5%CVE-2025-4702MEDIUMPHPGurukul Vehicle Parking Management System add-category.php sql injectionEPSS 0.5%CVE-2025-4709MEDIUMCampcodes Sales and Inventory System transaction_del.php sql injectionEPSS 0.5%CVE-2025-4706MEDIUMprojectworlds Online Examination System Procedure3b_yearwiseVisit.php sql injectionEPSS 0.5%CVE-2025-4741MEDIUMCampcodes Sales and Inventory System purchase_add.php sql injectionEPSS 0.5%CVE-2025-4931MEDIUMprojectworlds Online Lawyer Management System user_registation.php sql injectionEPSS 0.5%CVE-2025-4723MEDIUMitsourcecode Placement Management System all_student.php sql injectionEPSS 0.5%CVE-2025-4771MEDIUMPHPGurukul Online Course Registration course.php sql injectionEPSS 0.5%CVE-2025-4698MEDIUMPHPGurukul Directory Management System forget-password.php sql injectionEPSS 0.5%CVE-2025-4719MEDIUMCampcodes Sales and Inventory System cash_transaction.php sql injectionEPSS 0.5%CVE-2025-4715MEDIUMCampcodes Sales and Inventory System view_application.php sql injectionEPSS 0.5%CVE-2025-5079MEDIUMPHPGurukul/Campcodes Online Shopping Portal updateorder.php sql injectionEPSS 0.5%CVE-2025-4935MEDIUMSourceCodester Stock Management System changePassword.php sql injectionEPSS 0.5%CVE-2025-4301MEDIUMitsourcecode Content Management System search-notice.php sql injectionEPSS 0.5%CVE-2025-6153MEDIUMPHPGurukul Hostel Management System students.php sql injectionEPSS 0.5%CVE-2025-6354MEDIUMcode-projects Online Shoe Store customer_signup.php sql injectionEPSS 0.5%CVE-2025-4718MEDIUMCampcodes Sales and Inventory System customer_add.php sql injectionEPSS 0.5%CVE-2026-4470MEDIUMitsourcecode Online Frozen Foods Ordering System admin_edit_menu.php sql injectionEPSS 0.5%CVE-2025-5004MEDIUMprojectworlds Online Time Table Generator add_course.php sql injectionEPSS 0.5%CVE-2025-4311MEDIUMitsourcecode Content Management System update_main_topic_img.php sql injectionEPSS 0.5%