Weaknesses of type CWE-74

4,743 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-47867HIGHA Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbiEPSS 1.9%CVE-2025-11073MEDIUMKeyfactor RG-EW5100BE HTTP POST Request cmd command injectionEPSS 1.9%CVE-2017-17520HIGHtools/url_handler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, whicEPSS 1.9%CVE-2026-1596MEDIUMD-Link DWR-M961 formLtefotaUpgradeQuectel sub_419920 command injectionEPSS 1.9%CVE-2023-29522CRITICALCode injection from view right on XWiki.ClassSheet in xwiki-platformEPSS 1.9%CVE-2023-29514CRITICALCode injection in template provider administration in xwiki-platformEPSS 1.9%CVE-2023-29510CRITICALCode injection via unescaped translations in xwiki-platformEPSS 1.9%CVE-2023-32679HIGHRemote Code Execution via unrestricted file extension in Craft CMSEPSS 1.8%CVE-2021-39187HIGHCrash server with query parameterEPSS 1.8%CVE-2026-75985MEDIUMTRENDnet Router ping.cgi command injectionEPSS 1.8%CVE-2026-19022MEDIUMOpenHands send_pull_request.py initialize_repo command injectionEPSS 1.8%CVE-2026-5327MEDIUMefforthye fast-filesystem-mcp index.ts handleGetDiskUsage command injectionEPSS 1.8%CVE-2026-3680MEDIUMRyuzakiShinji biome-mcp-server biome-mcp-server.ts command injectionEPSS 1.8%CVE-2026-76583MEDIUMTRENDnet TV-IP751WIC alphapd set_time.cgi command injectionEPSS 1.8%CVE-2026-75984MEDIUMTRENDnet TEW-823DRU admin.cgi command injectionEPSS 1.8%CVE-2026-7629MEDIUMkleneway awesome-cursor-mpc-server Ccode-Review Tool codeReview.ts runCodeReviewTool command injectionEPSS 1.8%CVE-2026-19268MEDIUMabdullah1854 MCPGateway Claude Usage Range Endpoint claude-usage.ts getUsageByDateRange command injectionEPSS 1.8%CVE-2026-82597MEDIUMTOTOLINK NR1800X cstecgi.cgi setUssd command injectionEPSS 1.8%CVE-2026-75011MEDIUMkylecui NetForensicMCP index.js execAsync command injectionEPSS 1.8%CVE-2026-4192MEDIUMAvinashBole quip-mcp-server index.ts setupToolHandlers command injectionEPSS 1.8%