Weaknesses of type CWE-74

4,742 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-15481HIGHTrendnet TEW-635BRM IPoA WAN Connection Setup rc ipoa_test command injectionEPSS 2.9%CVE-2025-56266CRITICALA Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL.EPSS 2.9%CVE-2026-9423MEDIUMEdimax BR-6675nD POST Request mp command injectionEPSS 2.9%CVE-2026-19976MEDIUMCOMFAST CF-N1-S mbox-config sub_44A968 command injectionEPSS 2.9%CVE-2026-2533MEDIUMTosei Self-service Washing Machine tosei_datasend.php command injectionEPSS 2.9%CVE-2021-32647HIGHPost-authentication Remote Code Execution (RCE) in emissary:emissaryEPSS 2.9%CVE-2025-7525MEDIUMTOTOLINK T6 HTTP POST Request cstecgi.cgi setTracerouteCfg command injectionEPSS 2.8%CVE-2025-7524MEDIUMTOTOLINK T6 HTTP POST Request cstecgi.cgi setDiagnosisCfg command injectionEPSS 2.8%CVE-2024-37759CRITICALDataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerability via the Data ViEPSS 2.8%CVE-2023-37897HIGHServer-side Template Injection (SSTI) in gravEPSS 2.8%CVE-2025-4121MEDIUMNetgear JWNR2000v2 cmd_wireless command injectionEPSS 2.8%CVE-2025-50578CRITICALLinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically `X-Forwarded-Host` aEPSS 2.8%CVE-2025-3249MEDIUMTOTOLINK A6000R mtkwifi.lua apcli_cancel_wps command injectionEPSS 2.8%CVE-2026-78141MEDIUMTenda CH22 exeCommand formexeCommand command injectionEPSS 2.7%CVE-2026-78063MEDIUMTenda CH22 editFileName formeditFileName command injectionEPSS 2.7%CVE-2026-77031MEDIUMTenda CH22 formcreateFileName command injectionEPSS 2.7%CVE-2025-1448MEDIUMSynway SMG Gateway Management Software 9-12ping.php command injectionEPSS 2.7%CVE-2021-21277HIGHAngular Expressions - Remote Code ExecutionEPSS 2.7%CVE-2026-19346HIGHTenda CH22 CertListInfo formCertListInfo command injectionEPSS 2.7%CVE-2026-1624MEDIUMD-Link DWR-M961 formLtefotaUpgradeFibocom command injectionEPSS 2.7%