Fallos del tipo CWE-74

4734 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2026-90704MEDIUMD-Link DWR-M921 formDiskPartition system command injectionEPSS 2.3%CVE-2023-40035HIGHCraft CMS vulnerable to Remote Code Execution via validatePath bypassEPSS 2.3%CVE-2023-41834—Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF SequencesEPSS 2.3%CVE-2026-86295MEDIUMD-Link DIR-895L udhcpcd serverpacket.c sendACK command injectionEPSS 2.3%CVE-2020-28246CRITICALA Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default EPSS 2.3%CVE-2022-31086MEDIUMIncorrect Regular Expressions in ldap-account-managerEPSS 2.3%CVE-2026-1623MEDIUMTotolink A7000R cstecgi.cgi setUpgradeFW command injectionEPSS 2.3%CVE-2026-18980MEDIUMnearai ironclaw shell.rs classify_command_risk command injectionEPSS 2.3%CVE-2024-0579MEDIUMTotolink X2000R formMapDelDevice command injectionEPSS 2.2%CVE-2025-0328MEDIUMKaiYuanTong ECT Platform HTTP POST Request runCode.php command injectionEPSS 2.2%CVE-2026-15035MEDIUMbentoml OpenLLM Model Repository Directory Name common.py async_run_command command injectionEPSS 2.2%CVE-2025-14184MEDIUMSGAI Space1 NAS N1211DS gsaiagent JSONAPI NGNIX_UPLOAD command injectionEPSS 2.2%CVE-2026-31816CRITICALBudibase Universal Auth Bypass via Webhook Query Param InjectionEPSS 2.2%CVE-2026-93965MEDIUMaiyiyi121 SxDevOps MCP STDIO Server Management services.py subprocess.Popen command injectionEPSS 2.2%CVE-2026-93966MEDIUMaiyiyi121 SxDevOps TASK_RUN_COMMAND host_tasks.py paramiko.SSHClient.exec_command command injectionEPSS 2.2%CVE-2026-13538MEDIUMWavlink WL-NU516U1-A POST Parameter wireless.cgi sub_401D68 command injectionEPSS 2.2%CVE-2017-16719—An Injection issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPEPSS 2.2%CVE-2022-31631CRITICALPDO::quote() may return unquoted stringEPSS 2.2%CVE-2021-32827MEDIUMArbitrary code execution in MockServerEPSS 2.2%CVE-2020-15146CRITICALRemote Code Execution in SyliusResourceBundleEPSS 2.1%