Weaknesses of type CWE-74

4,743 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-6219MEDIUMaandrew-me ytDownloader Compressor Feature compressor.js child_process.exec command injectionEPSS 1.4%CVE-2022-46337CRITICALApache Derby: LDAP injection vulnerability in authenticatorEPSS 1.4%CVE-2025-0565MEDIUMZZCMS index.php sql injectionEPSS 1.4%CVE-2026-8210MEDIUMaandrew-me tgpt Update helper.go helper.Update command injectionEPSS 1.4%CVE-2024-39704CRITICALSoft Circle French-Bread Melty Blood: Actress Again: Current Code through 1.07 Rev. 1.4.0 allows a remote attacker to execute arbitrary codeEPSS 1.4%CVE-2019-1680MEDIUMCisco Webex Business Suite Content Injection VulnerabilityEPSS 1.4%CVE-2022-33012HIGHMicroweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.EPSS 1.4%CVE-2022-35507MEDIUMA response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows EPSS 1.4%CVE-2021-43782MEDIUMIndirect LDAP injection in TuleapEPSS 1.4%CVE-2025-58046HIGHDataease has a JDBC attack vulnerability in the Impala datasourceEPSS 1.4%CVE-2021-21333MEDIUMHTML injection in email and account expiry notificationsEPSS 1.4%CVE-2023-43655MEDIUMRemote Code Execution via web-accessible composer.pharEPSS 1.4%CVE-2022-31179HIGHInsufficient escaping of line feeds for CMD in shescapeEPSS 1.4%CVE-2022-4064MEDIUMDalli Meta Protocol request_formatter.rb self.meta_set injectionEPSS 1.4%CVE-2022-29171MEDIUMRemote Code Execution in sourcegraphEPSS 1.4%CVE-2026-93371MEDIUMmarcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injectionEPSS 1.4%CVE-2022-41934CRITICALImproper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-menu-uiEPSS 1.3%CVE-2023-44373CRITICALAffected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges EPSS 1.3%CVE-2021-32649HIGHAuthenticated file write leads to remote code execution in october/systemEPSS 1.3%CVE-2021-29084HIGHImproper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in Security Advisor report EPSS 1.3%