Weaknesses of type CWE-74

4,743 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-4192MEDIUMAvinashBole quip-mcp-server index.ts setupToolHandlers command injectionEPSS 1.8%CVE-2026-75011MEDIUMkylecui NetForensicMCP index.js execAsync command injectionEPSS 1.8%CVE-2021-38458CRITICALMoxa MXview Network Management SoftwareEPSS 1.8%CVE-2025-14485LOWEFM ipTIME A3004T Administrator Password timepro.cgi show_debug_screen command injectionEPSS 1.8%CVE-2025-9744MEDIUMCampcodes Online Loan Management System ajax.php sql injectionEPSS 1.8%CVE-2025-10090MEDIUMJinher OA GetTreeDate.aspx sql injectionEPSS 1.8%CVE-2026-2130MEDIUMBurtTheCoder mcp-maigret search_username index.ts command injectionEPSS 1.8%CVE-2025-7160MEDIUMPHPGurukul Zoo Management System index.php sql injectionEPSS 1.8%CVE-2024-36420HIGHGHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-fileEPSS 1.8%CVE-2026-7721MEDIUMTotolink WA300 cstecgi.cgi NTPSyncWithHost command injectionEPSS 1.8%CVE-2026-77004MEDIUMComfast CF-N1-S mbox-config sprintf command injectionEPSS 1.8%CVE-2026-7718MEDIUMTotolink WA300 POST Request cstecgi.cgi setWebWlanIdx command injectionEPSS 1.8%CVE-2026-76582MEDIUMTRENDnet TEW-821DAP ssi ping.cgi system command injectionEPSS 1.8%CVE-2026-77945MEDIUMTRENDnet TEW-821DAP ssi upload.cgi command injectionEPSS 1.8%CVE-2026-7720MEDIUMTotolink WA300 POST Request cstecgi.cgi setLanguageCfg command injectionEPSS 1.8%CVE-2016-15004HIGHInfiniteWP Client Plugin injectionEPSS 1.8%CVE-2022-36323CRITICALAffected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges EPSS 1.7%CVE-2022-24832HIGHBundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernamesEPSS 1.7%CVE-2026-94099CRITICALNetcore NBR200V2 Backup Restore restore.cgi command injectionEPSS 1.7%CVE-2017-17514HIGHboxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might alloEPSS 1.7%