Fallos del tipo CWE-74

5079 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2021-4245MEDIUMchbrown rfc6902 pointer.ts prototype pollutionEPSS 1.4%CVE-2026-93371MEDIUMmarcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injectionEPSS 1.4%CVE-2026-1735LOWYealink MeetingBar A30 Diagnostic command injectionEPSS 1.3%CVE-2023-44373CRITICALAffected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges EPSS 1.3%CVE-2026-115969MEDIUMTravisun Opptrix Schedule API setup command injectionEPSS 1.3%CVE-2023-4212MEDIUMTrane Thermostats InjectionEPSS 1.3%CVE-2021-29084HIGHImproper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in Security Advisor report EPSS 1.3%CVE-2021-29085HIGHImproper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in file sharing management EPSS 1.3%CVE-2024-28114HIGHRemote Code Execution using Server Side Template Injection in Peering ManagerEPSS 1.3%CVE-2022-23064HIGHSnipe-IT - Host Header InjectionEPSS 1.3%CVE-2023-28637HIGHDataEase AWS redshift data source exists for remote code execution vulnerabilityEPSS 1.3%CVE-2022-24888MEDIUMPossible Injection in Nextcloud ServerEPSS 1.3%CVE-2022-31088MEDIUMUnauthenticated LDAP Injection in ldap-account-managerEPSS 1.3%CVE-2023-46726HIGHGLPI Remote code execution from LDAP server configuration form on PHP 7.4EPSS 1.3%CVE-2023-51388CRITICALHertzBeat AviatorScript Inject RCEEPSS 1.3%CVE-2021-41128CRITICALCSV Injection Vulnerability in HygeiaEPSS 1.3%CVE-2022-43720MEDIUMApache Superset: Improper rendering of user inputEPSS 1.3%CVE-2024-42472CRITICALFlatpak may allow access to files outside sandbox for certain appsEPSS 1.3%CVE-2026-8210MEDIUMaandrew-me tgpt Update helper.go helper.Update command injectionEPSS 1.3%CVE-2020-15244HIGHRCE in MagentoEPSS 1.3%