Weaknesses of type CWE-74

4,743 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2021-25994HIGHUserfrosting - Host-Header Injection Leads to Account TakeoverEPSS 1.5%CVE-2021-21381HIGHSandbox escape via special tokens in .desktop fileEPSS 1.5%CVE-2023-33234HIGHApache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configurationEPSS 1.5%CVE-2021-32756HIGHArbitrary eval through MiqExpressionEPSS 1.5%CVE-2020-15187LOWDuplicate plugin entries in HelmEPSS 1.5%CVE-2021-41232HIGHImproper Neutralization of Special Elements used in an LDAP QueryEPSS 1.5%CVE-2025-5569MEDIUMIdeaCMS getList.html Goods sql injectionEPSS 1.5%CVE-2022-45910MEDIUMApache ManifoldCF: LDAP Injection Vulnerability - ActiveDirectory AuthoritiesEPSS 1.5%CVE-2021-21247CRITICALPost-Auth Unsafe Deserialization on BasePage (AJAX)EPSS 1.5%CVE-2021-21244CRITICALPre-Auth SSTI via Bean validation message tamperingEPSS 1.5%CVE-2023-25613—LDAP Injection Vulnerability in Apache KerbyEPSS 1.5%CVE-2022-20001HIGHInjection in fishEPSS 1.5%CVE-2025-4851MEDIUMTOTOLINK N300RH cstecgi.cgi setUploadUserData command injectionEPSS 1.5%CVE-2025-4849MEDIUMTOTOLINK N300RH cstecgi.cgi CloudACMunualUpdateUserdata command injectionEPSS 1.5%CVE-2021-41276MEDIUMIndirect LDAP injection in TuleapEPSS 1.5%CVE-2025-2916MEDIUMAishida Call Center System amr2mp3 command injectionEPSS 1.5%CVE-2022-36084CRITICALcruddl vulnerable to AQL injection through flexSearchEPSS 1.5%CVE-2021-21248CRITICALPost-Auth Arbitrary Code execution via Groovy script injectionEPSS 1.5%CVE-2024-46997CRITICALDataEase's H2 datasource has a remote command execution riskEPSS 1.4%CVE-2023-43835HIGHSuper Store Finder 3.7 and below is vulnerable to authenticated Arbitrary PHP Code Injection that could lead to Remote Code Execution when sEPSS 1.4%