Fallos del tipo CWE-74

5079 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2022-33012HIGHMicroweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.EPSS 1.4%CVE-2025-7883HIGHEluktronics Control Center Powershell Script Command command injectionEPSS 1.4%CVE-2025-58046HIGHDataease has a JDBC attack vulnerability in the Impala datasourceEPSS 1.4%CVE-2022-31179HIGHInsufficient escaping of line feeds for CMD in shescapeEPSS 1.4%CVE-2026-7469MEDIUMTenda 4G300 DelFil sub_425A28 command injectionEPSS 1.4%CVE-2022-46337CRITICALApache Derby: LDAP injection vulnerability in authenticatorEPSS 1.4%CVE-2026-13501MEDIUMantlr ANTLR4 gofmt GoTarget.java GoTarget command injectionEPSS 1.4%CVE-2024-39704CRITICALSoft Circle French-Bread Melty Blood: Actress Again: Current Code through 1.07 Rev. 1.4.0 allows a remote attacker to execute arbitrary codeEPSS 1.4%CVE-2019-1680MEDIUMCisco Webex Business Suite Content Injection VulnerabilityEPSS 1.4%CVE-2022-4064MEDIUMDalli Meta Protocol request_formatter.rb self.meta_set injectionEPSS 1.4%CVE-2022-35948MEDIUMCRLF Injection in Nodejs ‘undici’ via Content-TypeEPSS 1.4%CVE-2026-3680MEDIUMRyuzakiShinji biome-mcp-server biome-mcp-server.ts command injectionEPSS 1.4%CVE-2026-10127MEDIUMEdimax BR-6478AC POST Request formStaDrvSetup command injectionEPSS 1.4%CVE-2025-10210MEDIUMyanyutao0402 ChanCMS Api.js search sql injectionEPSS 1.4%CVE-2021-32649HIGHAuthenticated file write leads to remote code execution in october/systemEPSS 1.4%CVE-2022-41934CRITICALImproper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-menu-uiEPSS 1.4%CVE-2025-7578LOWTeledyne FLIR FB-Series O/FLIR FH-Series ID runcmd.sh sendCommand command injectionEPSS 1.4%CVE-2021-21333MEDIUMHTML injection in email and account expiry notificationsEPSS 1.4%CVE-2022-29171MEDIUMRemote Code Execution in sourcegraphEPSS 1.4%CVE-2026-11406MEDIUMGL.iNet MT3000 OpenVPN Client Import Workflow ovpnclient.sh command injectionEPSS 1.4%