Weaknesses of type CWE-74

4,743 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2023-27479CRITICALImproper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-panels-uiEPSS 1.1%CVE-2023-29526CRITICALAsync and display macro allow displaying and interacting with any document in restricted modeEPSS 1.1%CVE-2023-29518CRITICALCode injection from view right using Invitation.InvitationCommon in xwiki-platformEPSS 1.1%CVE-2022-46162HIGHDiscourse BBCode plugin vulnerable to arbitrary CSS injectionEPSS 1.1%CVE-2025-5146MEDIUMNetcore NBR200V2 HTTP Header routerd passwd_set command injectionEPSS 1.1%CVE-2025-5147MEDIUMNetcore NBR1005GPEV2/NBR200V2/B6V2 network_tools tools_ping command injectionEPSS 1.1%CVE-2025-5145MEDIUMNetcore POWER13 Query String cgi-bin command injectionEPSS 1.1%CVE-2023-29521HIGHCode injection from account/view through VFS Tree macro in xwiki-platformEPSS 1.1%CVE-2022-45048HIGHApache Ranger: code execution vulnerability in policy expressionsEPSS 1.1%CVE-2021-41437MEDIUMAn HTTP response splitting attack in web application in ASUS RT-AX88U before v3.0.0.4.388.20558 allows an attacker to craft a specific URL tEPSS 1.1%CVE-2022-40958MEDIUMBy injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus ovEPSS 1.1%CVE-2022-45801—Apache StreamPark (incubating): LDAP Injection VulnerabilityEPSS 1.1%CVE-2026-11449MEDIUMGL.iNet GL-MT3000 LuCI JSON-RPC rpc rpc_sys command injectionEPSS 1.1%CVE-2019-3562—A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute codeEPSS 1.1%CVE-2021-43852HIGHJavaScript Prototype Pollution in oro/platformEPSS 1.1%CVE-2025-0944MEDIUMitsourcecode Tailoring Management System customerview.php sql injectionEPSS 1.1%CVE-2024-21742MEDIUMApache James Mime4J: Mime4J DOM header injectionEPSS 1.1%CVE-2023-29527CRITICALCode injection from account through AWM view sheet in xwiki platformEPSS 1.1%CVE-2024-11954MEDIUMPimcore Search Document cross site scriptingEPSS 1.1%CVE-2026-4199MEDIUMbazinga012 mcp_code_executor index.ts installDependencies command injectionEPSS 1.1%