Weaknesses of type CWE-74

4,741 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-1690MEDIUMTenda HG10 formSysCmd system command injectionEPSS 4.5%CVE-2026-18599HIGHGL.iNet GL-MT3000 Logread Lua RPC Plugin logread logread.set_config command injectionEPSS 4.4%CVE-2026-7833HIGHEFM ipTIME C200 ApplyRestore Endpoint iux_set.cgi sub_408F90 command injectionEPSS 4.4%CVE-2026-2118HIGHUTT HiPER 810 rehttpd formReleaseConnect sub_4407D4 command injectionEPSS 4.4%CVE-2026-2135MEDIUMUTT HiPER 810 formPdbUpConfig sub_43F020 command injectionEPSS 4.4%CVE-2026-7692MEDIUMWavlink WL-WN570HA1 adm.cgi ping_ddns command injectionEPSS 4.4%CVE-2026-7691MEDIUMWavlink WL-WN570HA1 adm.cgi set_sys_cmd command injectionEPSS 4.4%CVE-2025-8752MEDIUMwangzhixuan spring-shiro-training add command injectionEPSS 4.4%CVE-2026-7160HIGHTenda HG3 formTracert command injectionEPSS 4.4%CVE-2026-82595MEDIUMD-Link DIR-825M System Command Execution formSysCmd sub_456CF4 command injectionEPSS 4.4%CVE-2026-1412MEDIUMSangfor Operation and Maintenance Security Management System HTTP POST Request get_clip_img command injectionEPSS 4.3%CVE-2026-3484MEDIUMPhialsBasement nmap-mcp-server Nmap CLI index.ts child_process.exec command injectionEPSS 4.3%CVE-2022-4364MEDIUMTeledyne FLIR AX8 Web Service palette.php command injectionEPSS 4.3%CVE-2019-1939HIGHCisco Webex Teams Logging Feature Command Execution VulnerabilityEPSS 4.3%CVE-2021-21353MEDIUMRemote code execution in pugEPSS 4.3%CVE-2026-10878MEDIUMD-Link DWR-M920 formSmsManage sub_41C8E8 command injectionEPSS 4.2%CVE-2020-26238HIGHCritical vulnerability found in cron-utilsEPSS 4.2%CVE-2025-15391MEDIUMD-Link DIR-806A SSDP Request ssdpcgi_main command injectionEPSS 4.2%CVE-2025-15192MEDIUMD-Link DWR-M920 formLtefotaUpgradeQuectel sub_415328 command injectionEPSS 4.1%CVE-2025-15191MEDIUMD-Link DWR-M920 formLtefotaUpgradeFibocom sub_4155B4 command injectionEPSS 4.1%