Weaknesses of type CWE-74

4,740 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2020-8468HIGHTrend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escEPSS 6.2%KEVCVE-2026-4203MEDIUMD-Link DNS-1550-04 network_mgr.cgi cgi_dhcpd command injectionEPSS 6.1%CVE-2025-10814MEDIUMD-Link DIR-823X goahead command injectionEPSS 6.1%CVE-2026-2227MEDIUMD-Link DCS-931L setSystemAdmin doSystem command injectionEPSS 6.1%CVE-2023-29007HIGHArbitrary configuration injection via `git submodule deinit`EPSS 6.1%CVE-2026-7690MEDIUMWavlink WL-WN570HA1 adm.cgi set_sys_adm command injectionEPSS 6.0%CVE-2025-0528HIGHTenda AC8/AC10/AC18 HTTP Request telnet command injectionEPSS 5.9%CVE-2026-2163MEDIUMD-Link DIR-600 ssdp.cgi command injectionEPSS 5.9%CVE-2026-4209MEDIUMD-Link DNS-1550-04 account_mgr.cgi cgi_chg_admin_pw command injectionEPSS 5.8%CVE-2026-4196MEDIUMD-Link DNS-1550-04 remote_backup.cgi cgi_set_rsync_server command injectionEPSS 5.8%CVE-2026-4207MEDIUMD-Link DNS-1550-04 system_mgr.cgi cgi_ntp_time command injectionEPSS 5.8%CVE-2025-4445MEDIUMD-Link DIR-605L wake_on_lan command injectionEPSS 5.7%CVE-2025-9149MEDIUMWavlink WL-NU516U1 wireless.cgi sub_4032E4 command injectionEPSS 5.6%CVE-2026-1066MEDIUMkalcaddle kodbox Compression zip command injectionEPSS 5.6%CVE-2026-4195MEDIUMD-Link DNS-1550-04 wizard_mgr.cgi command injectionEPSS 5.5%CVE-2026-4210MEDIUMD-Link DNS-1550-04 time_machine.cgi cgi_tm_set_share command injectionEPSS 5.5%CVE-2026-4204MEDIUMD-Link DNS-1550-04 gui_mgr.cgi cgi_mycloud_auto_downlaod command injectionEPSS 5.5%CVE-2025-1800MEDIUMD-Link DAR-7000 HTTP POST Request sxh_vpnlic.php get_ip_addr_details command injectionEPSS 5.5%CVE-2025-10629MEDIUMD-Link DIR-852 Simple Service Discovery Protocol Service cgibin ssdpcgi_main command injectionEPSS 5.4%CVE-2026-3704MEDIUMWavlink NU516U1 Incomplete Fix CVE-2025-10959 firewall.cgi sub_405B2C command injectionEPSS 5.3%