Weaknesses of type CWE-74

4,743 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-19963MEDIUMEdimax EW-7478APC stainfo command injectionEPSS 2.0%CVE-2026-19960MEDIUMEdimax EW-7478APC formWlbasic command injectionEPSS 2.0%CVE-2026-19962MEDIUMEdimax EW-7478APC setWAN command injectionEPSS 2.0%CVE-2026-9359MEDIUMEdimax EW-7438RPn POST Request formHwSet command injectionEPSS 2.0%CVE-2026-9362MEDIUMEdimax EW-7438RPn Setting formConnectionSetting command injectionEPSS 2.0%CVE-2026-9440MEDIUMEdimax BR-6478AC POST Request formAccept command injectionEPSS 2.0%CVE-2018-18992—LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper sanitation, which may allow an attacker to execute EPSS 2.0%CVE-2023-27040CRITICALSimple Image Gallery v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the username parameter.EPSS 2.0%CVE-2026-12186HIGHGL.iNet GL-MT3000 Tor Proxy Service Configuration tor replace_country command injectionEPSS 2.0%CVE-2023-29519CRITICALCode injection in org.xwiki.platform:xwiki-platform-attachment-uiEPSS 1.9%CVE-2026-12187HIGHGL.iNet GL-MT3000 Online Firmware Upgrade one_click_upgrade command injectionEPSS 1.9%CVE-2022-31180CRITICALInsufficient escaping of whitespace in shescapeEPSS 1.9%CVE-2025-4135MEDIUMNetgear WG302v2 ui_get_input_value command injectionEPSS 1.9%CVE-2026-16448MEDIUMD-Link DNS-1550-04 remote_backup.cgi cgi_check_rsync_rw command injectionEPSS 1.9%CVE-2026-90880MEDIUMD-Link DSL-3782 Diagnostics Diagnostics.asp system command injectionEPSS 1.9%CVE-2023-36470CRITICALCode injection in icon themes of XWiki PlatformEPSS 1.9%CVE-2024-39604CRITICALA command execution vulnerability exists in the update_filter_url.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially craftedEPSS 1.9%CVE-2026-93965MEDIUMaiyiyi121 SxDevOps MCP STDIO Server Management services.py subprocess.Popen command injectionEPSS 1.9%CVE-2021-29454HIGHSandbox Escape by math function in smartyEPSS 1.9%CVE-2020-15143HIGHRemote Code Execution in SyliusResourceBundleEPSS 1.9%