Weaknesses of type CWE-74

4,743 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2021-29085HIGHImproper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in file sharing management EPSS 1.3%CVE-2023-4212MEDIUMTrane Thermostats InjectionEPSS 1.3%CVE-2024-28114HIGHRemote Code Execution using Server Side Template Injection in Peering ManagerEPSS 1.3%CVE-2022-23064HIGHSnipe-IT - Host Header InjectionEPSS 1.3%CVE-2023-28637HIGHDataEase AWS redshift data source exists for remote code execution vulnerabilityEPSS 1.3%CVE-2022-24888MEDIUMPossible Injection in Nextcloud ServerEPSS 1.3%CVE-2025-9654MEDIUMAiondaDotCom mcp-ssh server-simple.mjs command injectionEPSS 1.3%CVE-2022-31088MEDIUMUnauthenticated LDAP Injection in ldap-account-managerEPSS 1.3%CVE-2023-46726HIGHGLPI Remote code execution from LDAP server configuration form on PHP 7.4EPSS 1.3%CVE-2021-4245MEDIUMchbrown rfc6902 pointer.ts prototype pollutionEPSS 1.3%CVE-2021-41128CRITICALCSV Injection Vulnerability in HygeiaEPSS 1.3%CVE-2023-51388CRITICALHertzBeat AviatorScript Inject RCEEPSS 1.3%CVE-2025-10210MEDIUMyanyutao0402 ChanCMS Api.js search sql injectionEPSS 1.3%CVE-2024-42472CRITICALFlatpak may allow access to files outside sandbox for certain appsEPSS 1.3%CVE-2022-35948MEDIUMCRLF Injection in Nodejs ‘undici’ via Content-TypeEPSS 1.3%CVE-2020-15244HIGHRCE in MagentoEPSS 1.3%CVE-2026-10127MEDIUMEdimax BR-6478AC POST Request formStaDrvSetup command injectionEPSS 1.3%CVE-2022-43720MEDIUMApache Superset: Improper rendering of user inputEPSS 1.3%CVE-2021-25980HIGHTalkyard - Host-Header Injection Leads to Account TakeoverEPSS 1.3%CVE-2026-1735LOWYealink MeetingBar A30 Diagnostic command injectionEPSS 1.2%