Weaknesses of type CWE-74

4,766 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-7536MEDIUMCampcodes Sales and Inventory System receipt_credit.php sql injectionEPSS 0.5%CVE-2025-8234MEDIUMcode-projects Online Ordering System delete_member.php sql injectionEPSS 0.5%CVE-2025-7521MEDIUMPHPGurukul Vehicle Parking Management System index.php sql injectionEPSS 0.5%CVE-2025-4933MEDIUMponaravindb Hospital-Management-System doctor-panel.php sql injectionEPSS 0.5%CVE-2025-55343CRITICALQuipux 4.0.1 through e1774ac allows authenticated users to conduct SQL injection attacks via busqueda/busqueda.php txt_depe_codi, busqueda/bEPSS 0.5%CVE-2024-11059MEDIUMProject Worlds Free Download Online Shopping System success.php sql injectionEPSS 0.5%CVE-2025-2053MEDIUMPHPGurukul Apartment Visitors Management System visitor-detail.php sql injectionEPSS 0.5%CVE-2025-13345MEDIUMSourceCodester Train Station Ticketing System ajax.php sql injectionEPSS 0.5%CVE-2025-0486MEDIUMFanli2012 native-php-cms login.php sql injectionEPSS 0.5%CVE-2025-1840MEDIUMESAFENET CDG updateorg.jsp sql injectionEPSS 0.5%CVE-2024-11127MEDIUMcode-projects Job Recruitment admin.php sql injectionEPSS 0.5%CVE-2025-3352MEDIUMPHPGurukul Old Age Home Management System edit-scdetails.php sql injectionEPSS 0.5%CVE-2025-3176MEDIUMProject Worlds Online Lawyer Management System single_lawyer.php sql injectionEPSS 0.5%CVE-2025-3846MEDIUMmarkparticle WebServer Registration httprequest.cpp sql injectionEPSS 0.5%CVE-2025-3172MEDIUMProject Worlds Online Lawyer Management System lawyer_booking.php sql injectionEPSS 0.5%CVE-2025-0946MEDIUMitsourcecode Tailoring Management System templatedelete.php sql injectionEPSS 0.5%CVE-2025-2037MEDIUMcode-projects Blood Bank Management System delete_requester.php sql injectionEPSS 0.5%CVE-2025-0789MEDIUMESAFENET CDG doneDetail.jsp sql injectionEPSS 0.5%CVE-2025-3351MEDIUMPHPGurukul Old Age Home Management System login.php sql injectionEPSS 0.5%CVE-2025-0945MEDIUMitsourcecode Tailoring Management System typedelete.php sql injectionEPSS 0.5%