Weaknesses of type CWE-74

4,768 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2024-12964MEDIUM1000 Projects Daily College Class Work Report Book login.php sql injectionEPSS 0.5%CVE-2025-3976MEDIUMPHPGurukul COVID19 Testing Management System new-user-testing.php sql injectionEPSS 0.5%CVE-2025-2389MEDIUMcode-projects Blood Bank Management System add_city.php sql injectionEPSS 0.5%CVE-2025-11314MEDIUMTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findSingConfigPage.do findRolePage sql injectionEPSS 0.5%CVE-2025-11312MEDIUMTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findModulePage.do findModulePage sql injectionEPSS 0.5%CVE-2025-11313MEDIUMTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findRolePage.do findRolePage sql injectionEPSS 0.5%CVE-2025-11317MEDIUMTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findSingConfigPage.do findRolePage sql injectionEPSS 0.5%CVE-2025-3974MEDIUMPHPGurukul COVID19 Testing Management System edit-phlebotomist.php sql injectionEPSS 0.5%CVE-2024-1128MEDIUMTutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&AEPSS 0.5%CVE-2024-10808MEDIUMcode-projects E-Health Care System req_detail.php sql injectionEPSS 0.5%CVE-2025-11311MEDIUMTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findTenantPage.do findTenantPage sql injectionEPSS 0.5%CVE-2025-4531MEDIUMSeeyon Zhiyuan OA Web Application System Beetl Template EhrSalaryPayrollServiceImpl.class postData code injectionEPSS 0.5%CVE-2025-11316MEDIUMTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findCategoryPage.do findCategoryPage sql injectionEPSS 0.5%CVE-2024-10809MEDIUMcode-projects E-Health Care System chat.php sql injectionEPSS 0.5%CVE-2025-11310MEDIUMTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findFileServerPage.do findFileServerPage sql injectionEPSS 0.5%CVE-2025-2118MEDIUMQuantico Tecnologia PRMV Login Endpoint login.php sql injectionEPSS 0.5%CVE-2025-11315MEDIUMTipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findUserPage.do findUserPage sql injectionEPSS 0.5%CVE-2025-3971MEDIUMPHPGurukul COVID19 Testing Management System add-phlebotomist.php sql injectionEPSS 0.5%CVE-2025-2392MEDIUMcode-projects Online Class and Exam Scheduling System activate.php sql injectionEPSS 0.5%CVE-2024-28191LOWContao may have unencoded insert tags in the frontendEPSS 0.5%