Weaknesses of type CWE-74

4,734 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-13442MEDIUMUTT 进取 750W formPdbUpConfig system command injectionEPSS 19.5%CVE-2025-14706CRITICALShiguangwu sgwbox N3 NETREBOOT http_eshell_server command injectionEPSS 18.6%CVE-2025-14707CRITICALShiguangwu sgwbox N3 DOCKER Feature http_eshell_server command injectionEPSS 18.6%CVE-2026-4197MEDIUMD-Link DNS-1550-04 download_mgr.cgi RSS_Item_List command injectionEPSS 18.4%CVE-2026-3662MEDIUMWavlink WL-NU516U1 adm.cgi usb_p910 command injectionEPSS 18.0%CVE-2024-23333HIGHLAM vulnerable to Authenticated Remote Code ExecutionEPSS 17.9%CVE-2024-38366CRITICALCoacoaPods trunk RCE in email verification system rfc-822EPSS 17.8%CVE-2026-2000MEDIUMDCN DCME-320 Web Management Backend bridge_cfg.php apply_config command injectionEPSS 17.8%CVE-2025-11331MEDIUMIdeaCMS Website Name Config.php command injectionEPSS 17.5%CVE-2026-3661MEDIUMWavlink WL-NU516U1 adm.cgi ota_new_upgrade command injectionEPSS 17.5%CVE-2026-2823MEDIUMComfast CF-E7 webmggnt mbox-config sub_41ACCC command injectionEPSS 17.4%CVE-2025-20284MEDIUMCisco Identity Services Engine Authenticated Remote Code Execution VulnerabilityEPSS 17.4%CVE-2025-4076MEDIUMLB-LINK BL-AC3600 Password lighttpd.cgi easy_uci_set_option_string_0 command injectionEPSS 17.3%CVE-2026-1419MEDIUMD-Link DCS700l Web Form setDayNightMode command injectionEPSS 17.2%CVE-2023-20858HIGHVMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A mEPSS 16.9%CVE-2025-14705CRITICALShiguangwu sgwbox N3 SHARESERVER Feature command injectionEPSS 16.5%CVE-2023-36812CRITICALRemote Code Execution in OpenTSDBEPSS 16.5%CVE-2026-2824MEDIUMComfast CF-E7 webmggnt mbox-config sub_441CF4 command injectionEPSS 15.9%CVE-2025-20265CRITICALCisco Secure Firewall Management Center Software Radius Remote Code Execution VulnerabilityEPSS 15.8%CVE-2026-1125MEDIUMD-Link DIR-823X set_wifidog_settings sub_412E7C command injectionEPSS 15.7%