Fallos del tipo CWE-74

4703 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2024-39704CRITICALSoft Circle French-Bread Melty Blood: Actress Again: Current Code through 1.07 Rev. 1.4.0 allows a remote attacker to execute arbitrary codeEPSS 1.4%CVE-2019-1680MEDIUMCisco Webex Business Suite Content Injection VulnerabilityEPSS 1.4%CVE-2025-8518MEDIUMgivanz Vvveb Code Editor code.php save code injectionEPSS 1.4%CVE-2022-35507MEDIUMA response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows EPSS 1.4%CVE-2026-79912MEDIUMTOTOLINK N600R cstecgi.cgi getCurrentTime command injectionEPSS 1.4%CVE-2026-9359MEDIUMEdimax EW-7438RPn POST Request formHwSet command injectionEPSS 1.4%CVE-2026-9297MEDIUMEdimax BR-6428NS POST Request formWlbasic command injectionEPSS 1.4%CVE-2021-43782MEDIUMIndirect LDAP injection in TuleapEPSS 1.4%CVE-2026-18599HIGHGL.iNet GL-MT3000 Logread Lua RPC Plugin logread logread.set_config command injectionEPSS 1.4%CVE-2025-58046HIGHDataease has a JDBC attack vulnerability in the Impala datasourceEPSS 1.4%CVE-2021-21333MEDIUMHTML injection in email and account expiry notificationsEPSS 1.4%CVE-2023-43655MEDIUMRemote Code Execution via web-accessible composer.pharEPSS 1.4%CVE-2026-9453MEDIUMFoundDream miniclawd SkillsLoader skills-loader.ts which command injectionEPSS 1.4%CVE-2022-4064MEDIUMDalli Meta Protocol request_formatter.rb self.meta_set injectionEPSS 1.4%CVE-2022-31179HIGHInsufficient escaping of line feeds for CMD in shescapeEPSS 1.4%CVE-2026-93371MEDIUMmarcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injectionEPSS 1.4%CVE-2023-44373CRITICALAffected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges EPSS 1.3%CVE-2026-7812MEDIUM54yyyu code-mcp MCP Tool server.py git_operation command injectionEPSS 1.3%CVE-2026-7215MEDIUMegtai gmx-vmd-mcp VMD Launch mcp_server.py launch_vmd_gui_tool command injectionEPSS 1.3%CVE-2026-7157MEDIUMdisler aider-mcp-server aider_ai_code server.py command injectionEPSS 1.3%