Fallos del tipo CWE-74

5079 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2026-11447MEDIUMGL.iNet GL-MT3000 MTK Backend iwinfo.so iwinfo_backend command injectionEPSS 1.2%CVE-2026-10166MEDIUMEdimax BR-6478AC POST Request formWlbasic command injectionEPSS 1.2%CVE-2022-40958MEDIUMBy injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus ovEPSS 1.2%CVE-2026-10550MEDIUMelunez eladmin Application Deployment App.java command injectionEPSS 1.2%CVE-2023-25141HIGHJNDI injection into Apache sling-org-apache-sling-jcr-baseEPSS 1.2%CVE-2026-102243MEDIUMMODSetter SurfSense MCP Connector Integration test command injectionEPSS 1.2%CVE-2026-94139MEDIUMChengdu Feiyuxing Technology Feiyu Star Router Cookie send_order.cgi command injectionEPSS 1.2%CVE-2020-15140HIGHRemote Code Execution in Red Discord BotEPSS 1.2%CVE-2026-10180MEDIUMTRENDnet TEW-432BRP formSysCmd command injectionEPSS 1.2%CVE-2021-38395CRITICALHoneywell Experion PKS and ACE Controllers InjectionEPSS 1.2%CVE-2023-27479CRITICALImproper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-panels-uiEPSS 1.1%CVE-2023-29526CRITICALAsync and display macro allow displaying and interacting with any document in restricted modeEPSS 1.1%CVE-2023-29518CRITICALCode injection from view right using Invitation.InvitationCommon in xwiki-platformEPSS 1.1%CVE-2023-29512CRITICALCode injection in xwiki-platform-web-templatesEPSS 1.1%CVE-2023-29521HIGHCode injection from account/view through VFS Tree macro in xwiki-platformEPSS 1.1%CVE-2021-43852HIGHJavaScript Prototype Pollution in oro/platformEPSS 1.1%CVE-2022-45048HIGHApache Ranger: code execution vulnerability in policy expressionsEPSS 1.1%CVE-2021-41437MEDIUMAn HTTP response splitting attack in web application in ASUS RT-AX88U before v3.0.0.4.388.20558 allows an attacker to craft a specific URL tEPSS 1.1%CVE-2024-11954MEDIUMPimcore Search Document cross site scriptingEPSS 1.1%CVE-2025-0944MEDIUMitsourcecode Tailoring Management System customerview.php sql injectionEPSS 1.1%