Weaknesses of type CWE-74

4,741 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-8344MEDIUMD-Link DIR-816 formDMZ.cgi sub_445E7C command injectionEPSS 5.0%CVE-2026-79697CRITICALAdvantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injectionEPSS 4.9%CVE-2026-1414MEDIUMSangfor Operation and Maintenance Security Management System HTTP POST Request get_Information getInformation command injectionEPSS 4.9%CVE-2026-4543MEDIUMWavlink WL-WN578W2 POST Request firewall.cgi command injectionEPSS 4.9%CVE-2025-4340MEDIUMD-Link DIR-890L/DIR-806A1 soap.cgi sub_175C8 command injectionEPSS 4.9%CVE-2020-26282CRITICALTemplate Injection in BrowserUp ProxyEPSS 4.8%CVE-2026-29053HIGHGhost Vulnerable to Remote Code Execution via Malicious ThemesEPSS 4.8%CVE-2025-10123MEDIUMD-Link DIR-823X set_static_leases sub_415028 command injectionEPSS 4.7%CVE-2025-5126HIGHTeledyne FLIR AX8 settingsregional.php setDataTime command injectionEPSS 4.7%CVE-2026-18686CRITICALGL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injectionEPSS 4.7%CVE-2025-5763MEDIUMTenda CP3 apollo sub_F3C8C command injectionEPSS 4.7%CVE-2026-6987MEDIUMPicoClaw Web Launcher Management Plane restart command injectionEPSS 4.7%CVE-2025-11335MEDIUMD-Link DI-7100G C1 jhttpd msp_info.htm sub_46409C command injectionEPSS 4.6%CVE-2026-3943MEDIUMH3C ACG1000-AK230 aaa_portal_auth_local_submit command injectionEPSS 4.6%CVE-2020-15238HIGHLocal privilege escalation BluemanEPSS 4.6%CVE-2026-1064MEDIUMbastillion-io Bastillion System Management SystemKtrl.java command injectionEPSS 4.6%CVE-2026-1063MEDIUMbastillion-io Bastillion Public Key Management System AuthKeysKtrl.java command injectionEPSS 4.6%CVE-2025-15357MEDIUMD-Link DI-7400G+ msp_info.htm command injectionEPSS 4.6%CVE-2025-10689MEDIUMD-Link DIR-645 soap.cgi soapcgi_main command injectionEPSS 4.6%CVE-2026-2085HIGHD-Link DWR-M921 USSD Configuration Endpoint formUSSDSetup sub_419F20 command injectionEPSS 4.5%