Weaknesses of type CWE-74

4,742 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-1624MEDIUMD-Link DWR-M961 formLtefotaUpgradeFibocom command injectionEPSS 2.7%CVE-2024-49380HIGHPlenti arbitrary file write vulnerabilityEPSS 2.7%CVE-2025-5836MEDIUMTenda AC9 POST Request SetIPTVCfg formSetIptv command injectionEPSS 2.7%CVE-2026-0641MEDIUMTOTOLINK WA300 cstecgi.cgi sub_401510 command injectionEPSS 2.7%CVE-2025-14188HIGHUGREEN DH2100+ nas_svr create handler_file_backup_create command injectionEPSS 2.7%CVE-2025-6095MEDIUMcodesiddhant Jasmin Ransomware checklogin.php sql injectionEPSS 2.7%CVE-2026-1150MEDIUMTotolink LR350 POST Request cstecgi.cgi setTracerouteCfg command injectionEPSS 2.7%CVE-2025-4122MEDIUMNetgear JWNR2000v2 sub_435E04 command injectionEPSS 2.7%CVE-2026-7687MEDIUMlangflow-ai langflow Full Builtins code_parser.py CodeParser.parse_callable_details command injectionEPSS 2.6%CVE-2025-5139MEDIUMQualitor Office 365-type Connection testaConexaoOffice365.php command injectionEPSS 2.6%CVE-2025-15081MEDIUMJD Cloud BE6500 jdcapi sub_4780 command injectionEPSS 2.5%CVE-2025-5492MEDIUMD-Link DI-500WF-WT /usr/sbin/jhttpd msp_info.htm sub_456DE8 command injectionEPSS 2.5%CVE-2022-31014MEDIUMSMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud ServerEPSS 2.5%CVE-2021-43818HIGHHTML Cleaner allows crafted and SVG embedded scripts to pass throughEPSS 2.5%CVE-2026-2548MEDIUMWAYOS FBM-220G rc sub_40F820 command injectionEPSS 2.5%CVE-2026-3395MEDIUMMaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injectionEPSS 2.5%CVE-2018-18996—LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, which may allow an attEPSS 2.5%CVE-2025-2473MEDIUMPHPGurukul Company Visitor Management System Sign In index.php sql injectionEPSS 2.4%CVE-2022-40145CRITICALApache Karaf: JDBC JAAS LDAP injectionEPSS 2.4%CVE-2026-77988MEDIUMTRENDnet TEW-823DRU CLI Configuration Tool nvram_get command injectionEPSS 2.4%