Weaknesses of type CWE-74

4,768 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2024-56835HIGHA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEEPSS 0.5%CVE-2025-5363MEDIUMCampcodes Online Hospital Management System index.php sql injectionEPSS 0.5%CVE-2025-4869MEDIUMitsourcecode Restaurant Management System member_update.php sql injectionEPSS 0.5%CVE-2025-5251MEDIUMPHPGurukul News Portal Project edit-subcategory.php sql injectionEPSS 0.5%CVE-2025-5246MEDIUMCampcodes Online Hospital Management System query-details.php sql injectionEPSS 0.5%CVE-2025-5707MEDIUMPHPGurukul Human Metapneumovirus Testing Management System registered-user-testing.php sql injectionEPSS 0.5%CVE-2025-5360MEDIUMCampcodes Online Hospital Management System book-appointment.php sql injectionEPSS 0.5%CVE-2025-4928MEDIUMprojectworlds Online Lawyer Management System save_lawyer_edit_profile.php sql injectionEPSS 0.5%CVE-2025-4507MEDIUMCampcodes Online Food Ordering System add-item.php sql injectionEPSS 0.5%CVE-2025-4554MEDIUMPHPGurukul Apartment Visitors Management System bwdates-passreports-details.php sql injectionEPSS 0.5%CVE-2025-4508MEDIUMPHPGurukul e-Diary Management System my-profile.php sql injectionEPSS 0.5%CVE-2025-6293MEDIUMcode-projects Hostel Management System contact_manager.php sql injectionEPSS 0.5%CVE-2025-5359MEDIUMCampcodes Online Hospital Management System appointment-history.php sql injectionEPSS 0.5%CVE-2025-5056MEDIUMCampcodes Online Shopping Portal edit-products.php sql injectionEPSS 0.5%CVE-2025-5358MEDIUMPHPGurukul/Campcodes Cyber Cafe Management System bwdates-reports-details.php sql injectionEPSS 0.5%CVE-2025-6296MEDIUMcode-projects Hostel Management System empty_rooms.php sql injectionEPSS 0.5%CVE-2025-5224MEDIUMCampcodes Online Hospital Management System add-doctor.php sql injectionEPSS 0.5%CVE-2025-4927MEDIUMPHPGurukul Online Marriage Registration System between-dates-application-report.php sql injectionEPSS 0.5%CVE-2025-4885MEDIUMitsourcecode Sales and Inventory System product_add.php sql injectionEPSS 0.5%CVE-2025-4249MEDIUMPHPGurukul e-Diary Management System manage-categories.php sql injectionEPSS 0.5%