Weaknesses of type CWE-74

4,733 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2023-29524CRITICALCode injection from account through XWiki.SchedulerJobSheet in xwiki-platformEPSS 75.7%CVE-2021-21242CRITICALPre-Auth Unsafe Deserialization on AttachmentUploadServetEPSS 74.2%CVE-2026-22200HIGHosTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File ReadEPSS 73.9%CVE-2023-30547CRITICALSandbox Escape in vm2EPSS 72.1%CVE-2025-20337CRITICALCisco ISE API Unauthenticated Remote Code Execution VulnerabilityEPSS 67.6%KEVCVE-2023-29516CRITICALCode injection from view right on XWiki.AttachmentSelector in xwiki-platformEPSS 65.9%CVE-2024-50340HIGHAbility to change environment from query in symfony/runtimeEPSS 64.8%CVE-2025-4443MEDIUMD-Link DIR-605L sub_454F2C command injectionEPSS 57.6%CVE-2021-21243CRITICALPre-Auth Unsafe Deserialization on KubernetesResourceEPSS 54.5%CVE-2022-31126CRITICALUnauthenticated Remote Code Execution in Roxy-wiEPSS 52.6%CVE-2025-1338MEDIUMNUUO Camera handle_config.php print_file command injectionEPSS 51.1%CVE-2022-24760CRITICALCommand Injection in Parse serverEPSS 49.1%CVE-2024-46986CRITICALArbitrary file write leading to RCE in Camaleon CMSEPSS 41.0%CVE-2023-29374CRITICALIn LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec metEPSS 39.7%CVE-2026-3943MEDIUMH3C ACG1000-AK230 aaa_portal_auth_local_submit command injectionEPSS 39.5%CVE-2020-15227HIGHRemote Code Execution vulnerabilityEPSS 34.4%CVE-2022-24838MEDIUMCommand Injection in Appointment Emails for Nextcloud CalendarEPSS 33.0%CVE-2023-4548MEDIUMSPA-Cart eCommerce CMS GET Parameter search sql injectionEPSS 32.2%CVE-2026-3065MEDIUMHummerRisk Cloud Task Dry-run CloudTaskService.java CommandUtils.commonExecCmdWithResult command injectionEPSS 30.9%CVE-2024-11652MEDIUMEnGenius ENH1350EXT/ENS500-AC/ENS620EXT sn_https command injectionEPSS 30.2%