Weaknesses of type CWE-74
4,766 resultsInjeção de código
É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.
Example
Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.
How to mitigate
Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.
CVE-2025-3172MEDIUMProject Worlds Online Lawyer Management System lawyer_booking.php sql injectionEPSS 0.5%CVE-2025-2037MEDIUMcode-projects Blood Bank Management System delete_requester.php sql injectionEPSS 0.5%CVE-2025-3176MEDIUMProject Worlds Online Lawyer Management System single_lawyer.php sql injectionEPSS 0.5%CVE-2025-3847MEDIUMmarkparticle WebServer Login httprequest.cpp sql injectionEPSS 0.5%CVE-2025-5057MEDIUMCampcodes Online Shopping Portal insert-product.php sql injectionEPSS 0.5%CVE-2025-6295MEDIUMcode-projects Hostel Management System allocated_rooms.php sql injectionEPSS 0.5%CVE-2025-5364MEDIUMCampcodes Online Hospital Management System add-patient.php sql injectionEPSS 0.5%CVE-2025-4884MEDIUMitsourcecode Restaurant Management System assign_save.php sql injectionEPSS 0.5%CVE-2025-5362MEDIUMCampcodes Online Hospital Management System doctor-specilization.php sql injectionEPSS 0.5%CVE-2025-4504MEDIUMSourceCodester Online College Library System index.php sql injectionEPSS 0.5%CVE-2025-4509MEDIUMPHPGurukul e-Diary Management System manage-notes.php sql injectionEPSS 0.5%CVE-2025-4925MEDIUMPHPGurukul Daily Expense Tracker System expense-monthwise-reports-detailed.php sql injectionEPSS 0.5%CVE-2025-5229MEDIUMCampcodes Online Hospital Management System view-patient.php sql injectionEPSS 0.5%CVE-2025-4936MEDIUMprojectworlds Online Food Ordering System admin-page.php sql injectionEPSS 0.5%CVE-2024-56835HIGHA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEEPSS 0.5%CVE-2025-4553MEDIUMPHPGurukul Apartment Visitors Management System bwdates-reports-details.php sql injectionEPSS 0.5%CVE-2025-4927MEDIUMPHPGurukul Online Marriage Registration System between-dates-application-report.php sql injectionEPSS 0.5%CVE-2025-4869MEDIUMitsourcecode Restaurant Management System member_update.php sql injectionEPSS 0.5%CVE-2025-4505MEDIUMPHPGurukul Apartment Visitors Management System category.php sql injectionEPSS 0.5%CVE-2025-5360MEDIUMCampcodes Online Hospital Management System book-appointment.php sql injectionEPSS 0.5%