Fallos del tipo CWE-74

4691 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2022-45910MEDIUMApache ManifoldCF: LDAP Injection Vulnerability - ActiveDirectory AuthoritiesEPSS 1.5%CVE-2021-21247CRITICALPost-Auth Unsafe Deserialization on BasePage (AJAX)EPSS 1.5%CVE-2026-19092CRITICALTutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable ShadowingEPSS 1.5%CVE-2021-21244CRITICALPre-Auth SSTI via Bean validation message tamperingEPSS 1.5%CVE-2023-25613—LDAP Injection Vulnerability in Apache KerbyEPSS 1.5%CVE-2026-7548HIGHTotolink NR1800X cstecgi.cgi sub_41A68C command injectionEPSS 1.5%CVE-2022-20001HIGHInjection in fishEPSS 1.5%CVE-2021-41276MEDIUMIndirect LDAP injection in TuleapEPSS 1.5%CVE-2025-2916MEDIUMAishida Call Center System amr2mp3 command injectionEPSS 1.5%CVE-2021-21248CRITICALPost-Auth Arbitrary Code execution via Groovy script injectionEPSS 1.5%CVE-2025-4851MEDIUMTOTOLINK N300RH cstecgi.cgi setUploadUserData command injectionEPSS 1.4%CVE-2025-4849MEDIUMTOTOLINK N300RH cstecgi.cgi CloudACMunualUpdateUserdata command injectionEPSS 1.4%CVE-2024-46997CRITICALDataEase's H2 datasource has a remote command execution riskEPSS 1.4%CVE-2026-4192MEDIUMAvinashBole quip-mcp-server index.ts setupToolHandlers command injectionEPSS 1.4%CVE-2022-36084CRITICALcruddl vulnerable to AQL injection through flexSearchEPSS 1.4%CVE-2023-43835HIGHSuper Store Finder 3.7 and below is vulnerable to authenticated Arbitrary PHP Code Injection that could lead to Remote Code Execution when sEPSS 1.4%CVE-2025-0565MEDIUMZZCMS index.php sql injectionEPSS 1.4%CVE-2022-46337CRITICALApache Derby: LDAP injection vulnerability in authenticatorEPSS 1.4%CVE-2024-39704CRITICALSoft Circle French-Bread Melty Blood: Actress Again: Current Code through 1.07 Rev. 1.4.0 allows a remote attacker to execute arbitrary codeEPSS 1.4%CVE-2019-1680MEDIUMCisco Webex Business Suite Content Injection VulnerabilityEPSS 1.4%