Weaknesses of type CWE-74

5,078 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-4206MEDIUMD-Link DNS-1550-04 dsk_mgr.cgi ScanDisk_run_e2fsck command injectionEPSS 5.4%CVE-2025-4340MEDIUMD-Link DIR-890L/DIR-806A1 soap.cgi sub_175C8 command injectionEPSS 5.3%CVE-2025-1946MEDIUMhzmanyun Education and Training System exportPDF command injectionEPSS 5.2%CVE-2025-1947MEDIUMhzmanyun Education and Training System UploadImageController.java scorm command injectionEPSS 5.2%CVE-2025-10814MEDIUMD-Link DIR-823X goahead command injectionEPSS 5.2%CVE-2025-9149MEDIUMWavlink WL-NU516U1 wireless.cgi sub_4032E4 command injectionEPSS 5.2%CVE-2020-11002HIGHRemote Code Execution (RCE) vulnerability in dropwizard-validationEPSS 5.2%CVE-2021-43837HIGHTemplate injection in vault-cliEPSS 5.2%CVE-2024-10919MEDIUMdidi Super-Jacoco triggerUnitCover os command injectionEPSS 5.1%CVE-2025-5126HIGHTeledyne FLIR AX8 settingsregional.php setDataTime command injectionEPSS 5.1%CVE-2025-15257MEDIUMEdimax BR-6208AC Web-based Configuration formRoute command injectionEPSS 5.1%CVE-2025-5763MEDIUMTenda CP3 apollo sub_F3C8C command injectionEPSS 5.1%CVE-2025-12916MEDIUMSangfor Operation and Maintenance Security Management System Frontend portal_login command injectionEPSS 5.1%CVE-2025-10629MEDIUMD-Link DIR-852 Simple Service Discovery Protocol Service cgibin ssdpcgi_main command injectionEPSS 5.1%CVE-2026-5338MEDIUMTenda G103 Setting system.lua action_set_system_settings command injectionEPSS 5.0%CVE-2026-79697CRITICALAdvantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injectionEPSS 4.9%CVE-2026-29053HIGHGhost Vulnerable to Remote Code Execution via Malicious ThemesEPSS 4.9%CVE-2026-2118HIGHUTT HiPER 810 rehttpd formReleaseConnect sub_4407D4 command injectionEPSS 4.8%CVE-2026-2135MEDIUMUTT HiPER 810 formPdbUpConfig sub_43F020 command injectionEPSS 4.8%CVE-2025-9581MEDIUMComfast CF-N1 webmgnt multi_pppoe command injectionEPSS 4.8%