Weaknesses of type CWE-74

4,768 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-5252MEDIUMPHPGurukul News Portal Project edit-subadmin.php sql injectionEPSS 0.5%CVE-2025-4505MEDIUMPHPGurukul Apartment Visitors Management System category.php sql injectionEPSS 0.5%CVE-2025-5363MEDIUMCampcodes Online Hospital Management System index.php sql injectionEPSS 0.5%CVE-2025-5250MEDIUMPHPGurukul News Portal Project edit-category.php sql injectionEPSS 0.5%CVE-2025-4836MEDIUMProjectworlds Life Insurance Management System deleteAgent.php sql injectionEPSS 0.5%CVE-2025-4885MEDIUMitsourcecode Sales and Inventory System product_add.php sql injectionEPSS 0.5%CVE-2025-5225MEDIUMCampcodes Advanced Online Voting System index.php sql injectionEPSS 0.5%CVE-2025-5230MEDIUMPHPGurukul Online Nurse Hiring System bwdates-report-details.php sql injectionEPSS 0.5%CVE-2025-5361MEDIUMCampcodes Online Hospital Management System contact.php sql injectionEPSS 0.5%CVE-2025-5705MEDIUMcode-projects Real Estate Property Management System Property.php sql injectionEPSS 0.5%CVE-2026-2682MEDIUMTsinghua Unigroup Electronic Archives System prinReport.html sql injectionEPSS 0.5%CVE-2025-5710MEDIUMcode-projects Real Estate Property Management System InsertState.php sql injectionEPSS 0.5%CVE-2025-5711MEDIUMcode-projects Real Estate Property Management System InsertCity.php sql injectionEPSS 0.5%CVE-2025-8165MEDIUMcode-projects Food Review System approve_reservation.php sql injectionEPSS 0.5%CVE-2026-82666MEDIUMyaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injectionEPSS 0.5%CVE-2024-13193MEDIUMSEMCMS Image Library Management Page SEMCMS_Images.php sql injectionEPSS 0.5%CVE-2025-5709MEDIUMcode-projects Real Estate Property Management System InsertCategory.php sql injectionEPSS 0.5%CVE-2024-13085MEDIUMPHPGurukul Land Record System login.php sql injectionEPSS 0.5%CVE-2025-11037MEDIUMcode-projects E-Commerce Website admin_index_search.php sql injectionEPSS 0.5%CVE-2025-8932MEDIUM1000 Projects Sales Management System sales.php sql injectionEPSS 0.5%