Weaknesses of type CWE-74

4,734 results

Injeção de código

É quando uma aplicação incorpora dados não validados em um comando ou consulta que será interpretado como código. O atacante consegue injetar instruções maliciosas que são executadas com os privilégios da aplicação, como SQL, shell ou XML.

Example

Um formulário de login que monta uma query SQL concatenando diretamente a entrada do usuário: `SELECT * FROM usuarios WHERE email = '` + email_usuario + `'`. Um atacante digita `' OR '1'='1` e consegue bypassar a autenticação.

How to mitigate

Use prepared statements ou parameterized queries (bind variables), que separam dados de código. Valide e sanitize todas as entradas contra regras rígidas de whitelist, e aplique o princípio do menor privilégio nas contas de banco de dados e processos.

CVE-2025-14225MEDIUMD-Link DCS-930L alphapd setSystemAdmin command injectionEPSS 8.9%CVE-2025-10628MEDIUMD-Link DIR-852 Web Management hedwig.cgi command injectionEPSS 8.8%CVE-2025-5502MEDIUMTOTOLINK X15 formMapReboot command injectionEPSS 8.7%CVE-2026-2182HIGHUTT 进取 521G setSysAdm doSystem command injectionEPSS 8.7%CVE-2022-21705HIGHAuthenticated remote code execution in octobercmsEPSS 8.6%CVE-2024-34544CRITICALA command injection vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafteEPSS 8.5%CVE-2026-2529MEDIUMWavlink WL-WN579A3 wireless.cgi DeleteMac command injectionEPSS 8.5%CVE-2026-2527MEDIUMWavlink WL-WN579A3 login.cgi command injectionEPSS 8.5%CVE-2026-5183MEDIUMTRENDnet TEW-713RE addRouting sub_421494 command injectionEPSS 8.4%CVE-2022-0391HIGHA flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings intoEPSS 8.3%CVE-2025-2725HIGHH3C Magic BE18000 HTTP POST Request auth command injectionEPSS 8.3%CVE-2025-13306MEDIUMD-Link DWR-M920/DWR-M921/DIR-822K/DIR-825M formDebugDiagnosticRun system command injectionEPSS 8.3%CVE-2025-9586MEDIUMComfast CF-N1 webmgnt wireless_device_dissoc command injectionEPSS 8.3%CVE-2025-9584MEDIUMComfast CF-N1 webmgnt update_interface_png command injectionEPSS 8.3%CVE-2026-2528MEDIUMWavlink WL-WN579A3 wireless.cgi Delete_Mac_list command injectionEPSS 8.2%CVE-2026-2526MEDIUMWavlink WL-WN579A3 wireless.cgi multi_ssid command injectionEPSS 8.2%CVE-2026-2530MEDIUMWavlink WL-WN579A3 wireless.cgi AddMac command injectionEPSS 8.2%CVE-2022-23614HIGHCode injection in TwigEPSS 8.2%CVE-2025-10401MEDIUMD-Link DIR-823x diag_ping command injectionEPSS 8.2%CVE-2025-10961MEDIUMWavlink NU516U1 Delete_Mac_list wireless.cgi sub_4030C0 command injectionEPSS 8.1%