Weaknesses of type CWE-74

5,079 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-5020MEDIUMTotolink A3600R Parameter cstecgi.cgi setNoticeCfg command injectionEPSS 2.6%CVE-2025-15081MEDIUMJD Cloud BE6500 jdcapi sub_4780 command injectionEPSS 2.5%CVE-2026-7683MEDIUMEdimax BR-6428nC Web setWAN command injectionEPSS 2.5%CVE-2026-6118MEDIUMAstrBotDevs AstrBot MCP Endpoint tools.py add_mcp_server command injectionEPSS 2.5%CVE-2022-31014MEDIUMSMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud ServerEPSS 2.5%CVE-2025-2473MEDIUMPHPGurukul Company Visitor Management System Sign In index.php sql injectionEPSS 2.5%CVE-2026-102793CRITICALZiroom ZHOME A0101 set_time_zone command injectionEPSS 2.5%CVE-2018-18996—LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, which may allow an attEPSS 2.5%CVE-2026-5101MEDIUMTotolink A3300R Parameter cstecgi.cgi setLanCfg command injectionEPSS 2.4%CVE-2020-28246CRITICALA Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default EPSS 2.4%CVE-2026-5102MEDIUMTotolink A3300R Parameter cstecgi.cgi setSmartQosCfg command injectionEPSS 2.4%CVE-2026-77988MEDIUMTRENDnet TEW-823DRU CLI Configuration Tool nvram_get command injectionEPSS 2.4%CVE-2026-6576MEDIUMliangliangyy DjangoBlog WeChat Bot commonapi.py CommandHandler command injectionEPSS 2.4%CVE-2020-5219HIGHRemote Code Execution in Angular ExpressionsEPSS 2.4%CVE-2026-4163CRITICALWavlink WL-WN579A3 POST Request wireless.cgi GuestWifi command injectionEPSS 2.4%CVE-2026-1623MEDIUMTotolink A7000R cstecgi.cgi setUpgradeFW command injectionEPSS 2.4%CVE-2026-94098CRITICALNetcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injectionEPSS 2.4%CVE-2025-7614MEDIUMTOTOLINK T6 HTTP POST Request cstecgi.cgi delDevice command injectionEPSS 2.4%CVE-2025-7613MEDIUMTOTOLINK T6 HTTP POST Request cstecgi.cgi CloudSrvVersionCheck command injectionEPSS 2.4%CVE-2025-7615MEDIUMTOTOLINK T6 HTTP POST Request cstecgi.cgi clearPairCfg command injectionEPSS 2.4%