Weaknesses of type CWE-74
4,743 resultsInjeção de código
É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.
Example
Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.
How to mitigate
Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.
CVE-2024-39906HIGHRemote code execution in Haven IndieAuthClient (GHSL-2024-093)EPSS 1.0%CVE-2022-29166HIGHImproper handling of multiline messages in matrix-appservice-ircEPSS 1.0%CVE-2025-24364HIGHvaultwarden allows RCE in the admin panelEPSS 1.0%CVE-2025-2729HIGHH3C Magic BE18000 HTTP POST Request networkSetup command injectionEPSS 1.0%CVE-2025-2730HIGHH3C Magic BE18000 HTTP POST Request getssidname command injectionEPSS 1.0%CVE-2025-2728HIGHH3C Magic NX30 Pro/Magic NX400 getNetworkConf command injectionEPSS 1.0%CVE-2025-2731HIGHH3C Magic BE18000 HTTP POST Request getDualbandSync command injectionEPSS 1.0%CVE-2024-47180HIGHShields.io Remote Code Execution vulnerability in Dynamic JSON/TOML/YAML badgesEPSS 1.0%CVE-2024-12484MEDIUMCodezips Technical Discussion Forum signuppost.php sql injectionEPSS 1.0%CVE-2020-26293MEDIUMPossible XSS bypass if style tag is allowedEPSS 1.0%CVE-2026-18613CRITICALGL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injectionEPSS 1.0%CVE-2023-6648MEDIUMPHPGurukul Nipah Virus Testing Management System password-recovery.php sql injectionEPSS 1.0%CVE-2021-21316MEDIUMArbitrary code execution in less-openui5EPSS 1.0%CVE-2025-4467MEDIUMSourceCodester Online Student Clearance System edit-admin.php sql injectionEPSS 1.0%CVE-2023-39424CRITICALImproper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in RDPngFileUpload.dllEPSS 1.0%CVE-2025-0396HIGHexelban stats XPC Service shouldAcceptNewConnection command injectionEPSS 1.0%CVE-2022-31593—SAP Business One client - version 10.0 allows an attacker with low privileges, to inject code that can be executed by the application. An atEPSS 1.0%CVE-2025-3008MEDIUMNovastar CX40 NetFilter Utility netconfig popen command injectionEPSS 1.0%CVE-2024-11591MEDIUM1000 Projects Beauty Parlour Management System add-services.php sql injectionEPSS 1.0%CVE-2024-23830HIGHMantisBT Host Header Injection vulnerabilityEPSS 1.0%