Fallos del tipo CWE-74

4743 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2023-25719HIGHConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWiEPSS 1.1%CVE-2026-19282MEDIUMandreahaku llm_memory_mcp GitHooksManager.ts auto.capture command injectionEPSS 1.1%CVE-2025-3539HIGHH3C Magic BE18000 HTTP POST Request getBasicInfo FCGI_CheckStringIfContainsSemicolon command injectionEPSS 1.1%CVE-2025-3540HIGHH3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request getCapability FCGI_WizardProtoProcess command injectionEPSS 1.1%CVE-2025-3541HIGHH3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request getSpecs FCGI_WizardProtoProcess command injectionEPSS 1.1%CVE-2025-3542HIGHH3C Magic NX15/Magic NX400/Magic R3010 HTTP POST Request getsyncpppoecfg FCGI_WizardProtoProcess command injectionEPSS 1.1%CVE-2025-3544HIGHH3C Magic BE18000 HTTP POST Request getCapabilityWeb FCGI_CheckStringIfContainsSemicolon command injectionEPSS 1.1%CVE-2024-42489CRITICALPro Macros Remote Code Execution via Viewpdf and similar macrosEPSS 1.1%CVE-2025-3543HIGHH3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request setsyncpppoecfg FCGI_WizardProtoProcess command injectionEPSS 1.1%CVE-2025-3545HIGHH3C Magic BE18000 HTTP POST Request setLanguage FCGI_CheckStringIfContainsSemicolon command injectionEPSS 1.1%CVE-2021-39213MEDIUMIP restriction on GLPI API Bypass with custom header injectionEPSS 1.1%CVE-2024-23828HIGHNginx-UI authenticated RCE through injecting into the application config via CRLFEPSS 1.1%CVE-2026-12219MEDIUMYealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injectionEPSS 1.1%CVE-2026-10180MEDIUMTRENDnet TEW-432BRP formSysCmd command injectionEPSS 1.1%CVE-2021-21303MEDIUMInjection attack in HelmEPSS 1.0%CVE-2023-36471CRITICALHTML sanitizer allows form elements in restricted in org.xwiki.commons:xwiki-commons-xmlEPSS 1.0%CVE-2026-26164HIGHM365 Copilot Information Disclosure VulnerabilityEPSS 1.0%CVE-2025-2726HIGHH3C Magic BE18000 HTTP POST Request esps command injectionEPSS 1.0%CVE-2025-2732HIGHH3C Magic BE18000 HTTP POST Request getWifiNeighbour command injectionEPSS 1.0%CVE-2025-2727HIGHH3C Magic NX30 Pro HTTP POST Request getNetworkStatus command injectionEPSS 1.0%