Weaknesses of type CWE-74

5,078 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-4207MEDIUMD-Link DNS-1550-04 system_mgr.cgi cgi_ntp_time command injectionEPSS 6.3%CVE-2025-9603MEDIUMTelesquare TLR-2005KSH internet.cgi command injectionEPSS 6.2%CVE-2025-13562MEDIUMD-Link DIR-852 gena.cgi command injectionEPSS 6.2%CVE-2025-0528HIGHTenda AC8/AC10/AC18 HTTP Request telnet command injectionEPSS 6.2%CVE-2025-7836MEDIUMD-Link DIR-816L Environment Variable cgibin lxmldbc_system command injectionEPSS 6.2%CVE-2020-8468HIGHTrend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escEPSS 6.2%KEVCVE-2025-4445MEDIUMD-Link DIR-605L wake_on_lan command injectionEPSS 6.0%CVE-2025-7932MEDIUMD-Link DIR‑817L ssdpcgi lxmldbc_system command injectionEPSS 5.9%CVE-2026-4543MEDIUMWavlink WL-WN578W2 POST Request firewall.cgi command injectionEPSS 5.8%CVE-2025-10958MEDIUMWavlink NU516U1 AddMac wireless.cgi sub_403010 command injectionEPSS 5.6%CVE-2025-10960MEDIUMWavlink NU516U1 DeleteMac wireless.cgi sub_402D1C command injectionEPSS 5.6%CVE-2023-29007HIGHArbitrary configuration injection via `git submodule deinit`EPSS 5.6%CVE-2025-10325MEDIUMWavlink WL-WN578W2 login.cgi sub_401BA4 command injectionEPSS 5.6%CVE-2026-3704MEDIUMWavlink NU516U1 Incomplete Fix CVE-2025-10959 firewall.cgi sub_405B2C command injectionEPSS 5.6%CVE-2026-10060MEDIUMTRENDnet TEW-432BRP formSetRoute command injectionEPSS 5.5%CVE-2026-10061MEDIUMTRENDnet TEW-432BRP formWPS command injectionEPSS 5.5%CVE-2026-1066MEDIUMkalcaddle kodbox Compression zip command injectionEPSS 5.5%CVE-2025-1800MEDIUMD-Link DAR-7000 HTTP POST Request sxh_vpnlic.php get_ip_addr_details command injectionEPSS 5.5%CVE-2026-7690MEDIUMWavlink WL-WN570HA1 adm.cgi set_sys_adm command injectionEPSS 5.5%CVE-2022-25167—Apache Flume vulnerable to a JNDI RCE in JMSSourceEPSS 5.4%