Weaknesses of type CWE-74

5,079 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2020-15146CRITICALRemote Code Execution in SyliusResourceBundleEPSS 2.1%CVE-2026-1596MEDIUMD-Link DWR-M961 formLtefotaUpgradeQuectel sub_419920 command injectionEPSS 2.1%CVE-2024-36522CRITICALApache Wicket: Remote code execution via XSLT injectionEPSS 2.1%CVE-2026-19041MEDIUMMissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage command injectionEPSS 2.1%CVE-2023-51653CRITICALHertzbeat JMX JNDI RCEEPSS 2.1%CVE-2026-79912MEDIUMTOTOLINK N600R cstecgi.cgi getCurrentTime command injectionEPSS 2.1%CVE-2022-23616HIGHRemote code execution in xwiki-platformEPSS 2.1%CVE-2021-36313CRITICALDell EMC CloudLink 7.1 and all prior versions contain an OS command injection Vulnerability. A remote high privileged attacker, may potentiaEPSS 2.1%CVE-2026-120198CRITICALWAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injectionEPSS 2.1%CVE-2026-113391CRITICALDrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injectionEPSS 2.1%CVE-2022-39382CRITICALNODE_ENV in Keystone defaults to development with esbuildEPSS 2.1%CVE-2026-94138MEDIUMChengdu Feiyuxing Technology Feiyu Star Router send_order.cgi command injectionEPSS 2.1%CVE-2026-84059MEDIUMICP DAS UA-2200/UA-5200 CGI ArmAngstromInstructionSet command injectionEPSS 2.0%CVE-2026-108918CRITICALEdimax BR-6208AC formWlanMP command injectionEPSS 2.0%CVE-2025-7160MEDIUMPHPGurukul Zoo Management System index.php sql injectionEPSS 2.0%CVE-2026-10182MEDIUMTRENDnet TEW-432BRP formWlanSetup command injectionEPSS 2.0%CVE-2025-6403MEDIUMcode-projects School Fees Payment System student.php sql injectionEPSS 2.0%CVE-2023-29523CRITICALCode injection in display method used in user profiles in xwiki-platformEPSS 2.0%CVE-2026-94096CRITICALNetcore NBR200V2 LAN IP Configuration network_tools command injectionEPSS 2.0%CVE-2022-31180CRITICALInsufficient escaping of whitespace in shescapeEPSS 2.0%