Weaknesses of type CWE-74

4,843 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-10223MEDIUMNousResearch hermes-agent memory_tool.py _scan_memory_content injectionEPSS 0.2%CVE-2026-10210MEDIUMAstrBotDevs AstrBot skill_manager.py _sanitize_prompt_description injectionEPSS 0.2%CVE-2025-11279MEDIUMAxosoft Scrum and Bug Tracking Add Work Item csv injectionEPSS 0.2%CVE-2026-0843MEDIUMjiujiujia/victor123/wxw850227 jjjfood/jjjshop_food index sql injectionEPSS 0.2%CVE-2026-84740MEDIUMThe Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' ParameterEPSS 0.2%CVE-2026-101145MEDIUMEleveo Call Recording Software User Management userAddAction.do ldap injectionEPSS 0.2%CVE-2026-44455MEDIUMHono: Unvalidated JSX Tag Names in hono/jsx May Allow HTML InjectionEPSS 0.2%CVE-2025-4767MEDIUMdefog-ai introspect Test Endpoint integration_routes.py test_custom_tool code injectionEPSS 0.2%CVE-2025-6785MEDIUMTesla Model 3 Physical CAN Bus InjectionEPSS 0.2%CVE-2026-18875HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.2%CVE-2026-12175MEDIUMCodeAstro Student Attendance Management System createStudents.php sql injectionEPSS 0.2%CVE-2026-102912MEDIUMSourceCodester Online Leave Management System page reports sql injectionEPSS 0.2%CVE-2022-42544HIGHIn getView of AddAppNetworksFragment.java, there is a possible way to mislead the user about network add requests due to improper input valiEPSS 0.2%CVE-2025-66025MEDIUMCaido Improperly Handles External Links in MarkdownEPSS 0.2%CVE-2026-11558MEDIUMCodeAstro Payroll System home_salary.php sql injectionEPSS 0.2%CVE-2026-8795HIGHA YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. The hostnamEPSS 0.2%CVE-2026-24764LOWOpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel DescriptionsEPSS 0.2%CVE-2026-10171MEDIUMcode-projects Online Music Site AdminUpdateAlbum.php sql injectionEPSS 0.2%CVE-2026-10155MEDIUMBdtask Multi-Store Inventory Management System Accounts Report Accounts.php accounts_report_search sql injectionEPSS 0.2%CVE-2026-11529MEDIUMdesigncomputer mysql-mcp-server mysql URI server.py read_resource sql injectionEPSS 0.2%