Weaknesses of type CWE-74

4,742 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-5041MEDIUMcode-projects Chamber of Commerce Membership Management System pageMail.php fwrite command injectionEPSS 2.1%CVE-2026-19041MEDIUMMissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage command injectionEPSS 2.1%CVE-2023-51653CRITICALHertzbeat JMX JNDI RCEEPSS 2.1%CVE-2026-79912MEDIUMTOTOLINK N600R cstecgi.cgi getCurrentTime command injectionEPSS 2.1%CVE-2026-1638MEDIUMTenda AC21 mDMZSetCfg command injectionEPSS 2.1%CVE-2022-23616HIGHRemote code execution in xwiki-platformEPSS 2.1%CVE-2026-33475CRITICALLangflow GitHub Actions Shell InjectionEPSS 2.1%CVE-2021-32650HIGHArbitrary code execution in october/systemEPSS 2.1%CVE-2021-36313CRITICALDell EMC CloudLink 7.1 and all prior versions contain an OS command injection Vulnerability. A remote high privileged attacker, may potentiaEPSS 2.1%CVE-2026-7812MEDIUM54yyyu code-mcp MCP Tool server.py git_operation command injectionEPSS 2.1%CVE-2026-7157MEDIUMdisler aider-mcp-server aider_ai_code server.py command injectionEPSS 2.1%CVE-2026-7211MEDIUMdvladimirov MCP Git Search API mcp_server.py GitSearchRequest command injectionEPSS 2.1%CVE-2026-9453MEDIUMFoundDream miniclawd SkillsLoader skills-loader.ts which command injectionEPSS 2.1%CVE-2026-7058MEDIUM666ghj MiroFish Inter-Process Communication simulation_ipc.py SimulationIPCClient.send_command command injectionEPSS 2.1%CVE-2026-7215MEDIUMegtai gmx-vmd-mcp VMD Launch mcp_server.py launch_vmd_gui_tool command injectionEPSS 2.1%CVE-2026-7316MEDIUMeiliyaabedini aider-mcp code_with_ai aider_mcp.py command injectionEPSS 2.1%CVE-2026-94138MEDIUMChengdu Feiyuxing Technology Feiyu Star Router send_order.cgi command injectionEPSS 2.1%CVE-2026-84059MEDIUMICP DAS UA-2200/UA-5200 CGI ArmAngstromInstructionSet command injectionEPSS 2.0%CVE-2026-11451MEDIUMGL.iNet GL-MT3000 FTP Protocol glc snprintf command injectionEPSS 2.0%CVE-2025-8518MEDIUMgivanz Vvveb Code Editor code.php save code injectionEPSS 2.0%