Weaknesses of type CWE-74

5,078 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-3662MEDIUMWavlink WL-NU516U1 adm.cgi usb_p910 command injectionEPSS 20.3%CVE-2021-41163CRITICALRCE via malicious SNS subscription payloadEPSS 19.8%CVE-2025-4076MEDIUMLB-LINK BL-AC3600 Password lighttpd.cgi easy_uci_set_option_string_0 command injectionEPSS 19.8%CVE-2026-3661MEDIUMWavlink WL-NU516U1 adm.cgi ota_new_upgrade command injectionEPSS 19.7%CVE-2025-13442MEDIUMUTT 进取 750W formPdbUpConfig system command injectionEPSS 19.5%CVE-2026-2000MEDIUMDCN DCME-320 Web Management Backend bridge_cfg.php apply_config command injectionEPSS 19.5%CVE-2026-4197MEDIUMD-Link DNS-1550-04 download_mgr.cgi RSS_Item_List command injectionEPSS 19.4%CVE-2026-2823MEDIUMComfast CF-E7 webmggnt mbox-config sub_41ACCC command injectionEPSS 18.8%CVE-2025-14706CRITICALShiguangwu sgwbox N3 NETREBOOT http_eshell_server command injectionEPSS 18.6%CVE-2025-14707CRITICALShiguangwu sgwbox N3 DOCKER Feature http_eshell_server command injectionEPSS 18.6%CVE-2025-3983MEDIUMAMTT Hotel Broadband Operation System nlog_down.php command injectionEPSS 17.9%CVE-2024-38366CRITICALCoacoaPods trunk RCE in email verification system rfc-822EPSS 17.8%CVE-2024-23333HIGHLAM vulnerable to Authenticated Remote Code ExecutionEPSS 17.8%CVE-2025-11331MEDIUMIdeaCMS Website Name Config.php command injectionEPSS 17.5%CVE-2026-1419MEDIUMD-Link DCS700l Web Form setDayNightMode command injectionEPSS 17.2%CVE-2026-2824MEDIUMComfast CF-E7 webmggnt mbox-config sub_441CF4 command injectionEPSS 17.1%CVE-2026-3798MEDIUMComfast CF-AC100 Request Path mbox-config sub_44AC14 command injectionEPSS 17.0%CVE-2025-9090MEDIUMTenda AC20 Telnet Service telnet websFormDefine command injectionEPSS 16.9%CVE-2023-20858HIGHVMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A mEPSS 16.9%CVE-2026-31816CRITICALBudibase Universal Auth Bypass via Webhook Query Param InjectionEPSS 16.7%