Weaknesses of type CWE-74

4,768 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-14529MEDIUMCampcodes Retro Basketball Shoes Online Store admin_running.php sql injectionEPSS 0.5%CVE-2025-15206MEDIUMCampcodes Supplier Management System add_area.php sql injectionEPSS 0.5%CVE-2025-11036MEDIUMcode-projects E-Commerce Website admin_account_update.php sql injectionEPSS 0.5%CVE-2025-9592MEDIUMitsourcecode Apartment Management System bill_info.php sql injectionEPSS 0.5%CVE-2025-15207MEDIUMCampcodes Supplier Management System view_products.php sql injectionEPSS 0.5%CVE-2025-8935MEDIUM1000 Projects Sales Management System custcmp.php sql injectionEPSS 0.5%CVE-2025-11344MEDIUMILIAS Certificate Import code injectionEPSS 0.5%CVE-2025-12325MEDIUMSourceCodester Best Salon Management System forgot-password.php sql injectionEPSS 0.5%CVE-2025-4786MEDIUMSourceCodester/oretnom23 Stock Management System view_return sql injectionEPSS 0.5%CVE-2023-4478MEDIUMParameter tampering in the registration resulting in blocked accounts to be createdEPSS 0.5%CVE-2026-1121MEDIUMYonyou KSOA HTTP GET Parameter del_workplan.jsp sql injectionEPSS 0.5%CVE-2025-4248MEDIUMSourceCodester Simple To-Do List System complete_task.php sql injectionEPSS 0.5%CVE-2025-8960MEDIUMCampcodes Online Flight Booking Management System save_airlines.php sql injectionEPSS 0.5%CVE-2025-2664MEDIUMCodeZips Hospital Management System suadpeted.php sql injectionEPSS 0.5%CVE-2025-9021MEDIUMSourceCodester Online Bank Management System transfer.php sql injectionEPSS 0.5%CVE-2025-2044MEDIUMcode-projects Blood Bank Management System delete_bloodGroup.php sql injectionEPSS 0.5%CVE-2025-2039MEDIUMcode-projects Blood Bank Management System delete_members.php sql injectionEPSS 0.5%CVE-2025-9022MEDIUMSourceCodester Online Bank Management System statements.php sql injectionEPSS 0.5%CVE-2025-11314MEDIUMTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findSingConfigPage.do findRolePage sql injectionEPSS 0.5%CVE-2024-10809MEDIUMcode-projects E-Health Care System chat.php sql injectionEPSS 0.5%