Fallos del tipo CWE-74

4713 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2023-43655MEDIUMRemote Code Execution via web-accessible composer.pharEPSS 1.4%CVE-2026-9453MEDIUMFoundDream miniclawd SkillsLoader skills-loader.ts which command injectionEPSS 1.4%CVE-2022-4064MEDIUMDalli Meta Protocol request_formatter.rb self.meta_set injectionEPSS 1.4%CVE-2022-31179HIGHInsufficient escaping of line feeds for CMD in shescapeEPSS 1.4%CVE-2026-93371MEDIUMmarcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injectionEPSS 1.4%CVE-2023-44373CRITICALAffected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges EPSS 1.3%CVE-2026-7812MEDIUM54yyyu code-mcp MCP Tool server.py git_operation command injectionEPSS 1.3%CVE-2026-7157MEDIUMdisler aider-mcp-server aider_ai_code server.py command injectionEPSS 1.3%CVE-2026-7211MEDIUMdvladimirov MCP Git Search API mcp_server.py GitSearchRequest command injectionEPSS 1.3%CVE-2026-7215MEDIUMegtai gmx-vmd-mcp VMD Launch mcp_server.py launch_vmd_gui_tool command injectionEPSS 1.3%CVE-2026-7058MEDIUM666ghj MiroFish Inter-Process Communication simulation_ipc.py SimulationIPCClient.send_command command injectionEPSS 1.3%CVE-2026-19263MEDIUMINQUIRELAB mcp-bridge-api Servers Endpoint mcp-bridge.js command injectionEPSS 1.3%CVE-2021-32649HIGHAuthenticated file write leads to remote code execution in october/systemEPSS 1.3%CVE-2026-7316MEDIUMeiliyaabedini aider-mcp code_with_ai aider_mcp.py command injectionEPSS 1.3%CVE-2021-29085HIGHImproper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in file sharing management EPSS 1.3%CVE-2023-4212MEDIUMTrane Thermostats InjectionEPSS 1.3%CVE-2021-29084HIGHImproper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in Security Advisor report EPSS 1.3%CVE-2024-28114HIGHRemote Code Execution using Server Side Template Injection in Peering ManagerEPSS 1.3%CVE-2026-18980MEDIUMnearai ironclaw shell.rs classify_command_risk command injectionEPSS 1.3%CVE-2022-23064HIGHSnipe-IT - Host Header InjectionEPSS 1.3%