Fallos del tipo CWE-74

5079 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2026-108917CRITICALEdimax BR-6208AC formAutoFWupgrade command injectionEPSS 2.0%CVE-2024-39604CRITICALA command execution vulnerability exists in the update_filter_url.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially craftedEPSS 2.0%CVE-2026-19962MEDIUMEdimax EW-7478APC setWAN command injectionEPSS 2.0%CVE-2026-19960MEDIUMEdimax EW-7478APC formWlbasic command injectionEPSS 2.0%CVE-2026-19963MEDIUMEdimax EW-7478APC stainfo command injectionEPSS 2.0%CVE-2025-4135MEDIUMNetgear WG302v2 ui_get_input_value command injectionEPSS 2.0%CVE-2026-2130MEDIUMBurtTheCoder mcp-maigret search_username index.ts command injectionEPSS 2.0%CVE-2018-18992—LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper sanitation, which may allow an attacker to execute EPSS 2.0%CVE-2023-27040CRITICALSimple Image Gallery v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the username parameter.EPSS 2.0%CVE-2026-12186HIGHGL.iNet GL-MT3000 Tor Proxy Service Configuration tor replace_country command injectionEPSS 2.0%CVE-2025-47867HIGHA Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbiEPSS 1.9%CVE-2026-8753MEDIUMkalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injectionEPSS 1.9%CVE-2023-29519CRITICALCode injection in org.xwiki.platform:xwiki-platform-attachment-uiEPSS 1.9%CVE-2026-8774MEDIUMEdimax BR-6228NC POST Request mp command injectionEPSS 1.9%CVE-2026-6799MEDIUMComfast CF-N1-S Endpoint mbox-config command injectionEPSS 1.9%CVE-2026-12187HIGHGL.iNet GL-MT3000 Online Firmware Upgrade one_click_upgrade command injectionEPSS 1.9%CVE-2022-36323CRITICALAffected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges EPSS 1.9%CVE-2026-90880MEDIUMD-Link DSL-3782 Diagnostics Diagnostics.asp system command injectionEPSS 1.9%CVE-2026-16448MEDIUMD-Link DNS-1550-04 remote_backup.cgi cgi_check_rsync_rw command injectionEPSS 1.9%CVE-2023-36470CRITICALCode injection in icon themes of XWiki PlatformEPSS 1.9%