Weaknesses of type CWE-74

4,742 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2020-28246CRITICALA Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default EPSS 2.3%CVE-2022-31086MEDIUMIncorrect Regular Expressions in ldap-account-managerEPSS 2.3%CVE-2026-93742CRITICALTotolink A3002MU formWsc command injectionEPSS 2.3%CVE-2026-1623MEDIUMTotolink A7000R cstecgi.cgi setUpgradeFW command injectionEPSS 2.3%CVE-2026-18980MEDIUMnearai ironclaw shell.rs classify_command_risk command injectionEPSS 2.3%CVE-2024-0579MEDIUMTotolink X2000R formMapDelDevice command injectionEPSS 2.2%CVE-2025-0328MEDIUMKaiYuanTong ECT Platform HTTP POST Request runCode.php command injectionEPSS 2.2%CVE-2026-15035MEDIUMbentoml OpenLLM Model Repository Directory Name common.py async_run_command command injectionEPSS 2.2%CVE-2025-14184MEDIUMSGAI Space1 NAS N1211DS gsaiagent JSONAPI NGNIX_UPLOAD command injectionEPSS 2.2%CVE-2026-31816CRITICALBudibase Universal Auth Bypass via Webhook Query Param InjectionEPSS 2.2%CVE-2026-13538MEDIUMWavlink WL-NU516U1-A POST Parameter wireless.cgi sub_401D68 command injectionEPSS 2.2%CVE-2017-16719—An Injection issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPEPSS 2.2%CVE-2022-31631CRITICALPDO::quote() may return unquoted stringEPSS 2.2%CVE-2021-32827MEDIUMArbitrary code execution in MockServerEPSS 2.2%CVE-2020-15146CRITICALRemote Code Execution in SyliusResourceBundleEPSS 2.1%CVE-2022-4170CRITICALThe rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data wEPSS 2.1%CVE-2025-8937MEDIUMTOTOLINK N350R formSysCmd command injectionEPSS 2.1%CVE-2026-19263MEDIUMINQUIRELAB mcp-bridge-api Servers Endpoint mcp-bridge.js command injectionEPSS 2.1%CVE-2024-36522CRITICALApache Wicket: Remote code execution via XSLT injectionEPSS 2.1%CVE-2026-5041MEDIUMcode-projects Chamber of Commerce Membership Management System pageMail.php fwrite command injectionEPSS 2.1%