Weaknesses of type CWE-74

4,742 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2022-39265HIGHMail settings' command parameter injection in mybbEPSS 2.4%CVE-2020-5219HIGHRemote Code Execution in Angular ExpressionsEPSS 2.4%CVE-2026-6279CRITICALAvada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX HandlerEPSS 2.4%CVE-2026-12197HIGHRuijie EG105G-P JSON-RPC Diagnose Endpoint diagnose nslookup command injectionEPSS 2.4%CVE-2026-94098CRITICALNetcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injectionEPSS 2.4%CVE-2025-7615MEDIUMTOTOLINK T6 HTTP POST Request cstecgi.cgi clearPairCfg command injectionEPSS 2.4%CVE-2025-7613MEDIUMTOTOLINK T6 HTTP POST Request cstecgi.cgi CloudSrvVersionCheck command injectionEPSS 2.4%CVE-2025-7614MEDIUMTOTOLINK T6 HTTP POST Request cstecgi.cgi delDevice command injectionEPSS 2.4%CVE-2026-6799MEDIUMComfast CF-N1-S Endpoint mbox-config command injectionEPSS 2.4%CVE-2026-8753MEDIUMkalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injectionEPSS 2.4%CVE-2026-8777MEDIUMEdimax BR-6428NS POST Request formStaDrvSetup command injectionEPSS 2.4%CVE-2026-7705MEDIUMJD Cloud JDCOS Service jdcap set_iptv_info command injectionEPSS 2.4%CVE-2026-7682MEDIUMEdimax BR-6208AC L2TP Mode setWAN command injectionEPSS 2.4%CVE-2026-8774MEDIUMEdimax BR-6228NC POST Request mp command injectionEPSS 2.4%CVE-2026-6576MEDIUMliangliangyy DjangoBlog WeChat Bot commonapi.py CommandHandler command injectionEPSS 2.4%CVE-2026-94095CRITICALNetcore NBR200V2 Traceroute Diagnostic Feature network_tools command injectionEPSS 2.4%CVE-2026-90704MEDIUMD-Link DWR-M921 formDiskPartition system command injectionEPSS 2.3%CVE-2023-40035HIGHCraft CMS vulnerable to Remote Code Execution via validatePath bypassEPSS 2.3%CVE-2023-41834—Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF SequencesEPSS 2.3%CVE-2026-86295MEDIUMD-Link DIR-895L udhcpcd serverpacket.c sendACK command injectionEPSS 2.3%