Weaknesses of type CWE-74

4,734 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2026-3798MEDIUMComfast CF-AC100 Request Path mbox-config sub_44AC14 command injectionEPSS 15.5%CVE-2026-31816CRITICALBudibase Universal Auth Bypass via Webhook Query Param InjectionEPSS 15.3%CVE-2024-26020CRITICALAn arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead EPSS 15.2%CVE-2025-4357MEDIUMTenda RX3 telnet command injectionEPSS 15.0%CVE-2025-3983MEDIUMAMTT Hotel Broadband Operation System nlog_down.php command injectionEPSS 14.8%CVE-2023-7039MEDIUMByzoro S210 importexport.php injectionEPSS 14.2%CVE-2025-9090MEDIUMTenda AC20 Telnet Service telnet websFormDefine command injectionEPSS 14.1%CVE-2026-2535MEDIUMComfast CF-N1 V2 mbox-config sub_44AB9C command injectionEPSS 14.0%CVE-2026-2534MEDIUMComfast CF-N1 V2 mbox-config sub_44AC4C command injectionEPSS 13.5%CVE-2025-15139MEDIUMTRENDnet TEW-822DRE formWsc sub_43ACF4  command injectionEPSS 13.3%CVE-2026-9440MEDIUMEdimax BR-6478AC POST Request formAccept command injectionEPSS 13.0%CVE-2025-5504MEDIUMTOTOLINK X2000R formWsc command injectionEPSS 12.9%CVE-2023-22522CRITICALThis Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input intEPSS 12.8%CVE-2021-21305HIGHCode Injection vulnerability in CarrierWaveEPSS 12.7%CVE-2026-3612HIGHWavlink WL-NU516U1 OTA Online Upgrade adm.cgi sub_405AF4 command injectionEPSS 12.7%CVE-2025-15048MEDIUMTenda WH450 HTTP Request CheckTools command injectionEPSS 12.3%CVE-2026-4228MEDIUMLB-LINK BL-WR9000 set_wifi sub_458754 command injectionEPSS 12.2%CVE-2025-14107HIGHZSPACE Q2C NAS HTTP POST Request status zfilev2_api.SafeStatus command injectionEPSS 12.2%CVE-2025-14106HIGHZSPACE Q2C NAS HTTP POST Request close zfilev2_api.CloseSafe command injectionEPSS 12.1%CVE-2026-2615HIGHWavlink WL-NU516U1 firewall.cgi singlePortForwardDelete command injectionEPSS 12.0%