Fallos del tipo CWE-74

5079 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2025-3546HIGHH3C Magic BE18000 HTTP POST Request getLanguage FCGI_CheckStringIfContainsSemicolon command injectionEPSS 1.6%CVE-2021-25994HIGHUserfrosting - Host-Header Injection Leads to Account TakeoverEPSS 1.6%CVE-2025-14276MEDIUMIlevia EVE X1 Server leaf_search.php command injectionEPSS 1.6%CVE-2020-26298MEDIUMInjection in RedcarpetEPSS 1.6%CVE-2021-41170CRITICALEvaluation of closures can lead to execution of methods & functions in current program scopeEPSS 1.6%CVE-2020-7475—A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), reflective DLL, vulnerability EPSS 1.6%CVE-2025-5569MEDIUMIdeaCMS getList.html Goods sql injectionEPSS 1.6%CVE-2026-93966MEDIUMaiyiyi121 SxDevOps TASK_RUN_COMMAND host_tasks.py paramiko.SSHClient.exec_command command injectionEPSS 1.6%CVE-2022-45910MEDIUMApache ManifoldCF: LDAP Injection Vulnerability - ActiveDirectory AuthoritiesEPSS 1.6%CVE-2026-113396MEDIUMDrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injectionEPSS 1.6%CVE-2025-4851MEDIUMTOTOLINK N300RH cstecgi.cgi setUploadUserData command injectionEPSS 1.5%CVE-2025-4849MEDIUMTOTOLINK N300RH cstecgi.cgi CloudACMunualUpdateUserdata command injectionEPSS 1.5%CVE-2026-116504CRITICALTOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injectionEPSS 1.5%CVE-2021-21381HIGHSandbox escape via special tokens in .desktop fileEPSS 1.5%CVE-2023-33234HIGHApache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configurationEPSS 1.5%CVE-2021-32756HIGHArbitrary eval through MiqExpressionEPSS 1.5%CVE-2023-43655MEDIUMRemote Code Execution via web-accessible composer.pharEPSS 1.5%CVE-2021-41276MEDIUMIndirect LDAP injection in TuleapEPSS 1.5%CVE-2026-9453MEDIUMFoundDream miniclawd SkillsLoader skills-loader.ts which command injectionEPSS 1.5%CVE-2021-21247CRITICALPost-Auth Unsafe Deserialization on BasePage (AJAX)EPSS 1.5%