Fallos del tipo CWE-74

4743 resultados

Injeção de código ou comando

A aplicação constrói comandos ou queries dinâmicas concatenando entrada do usuário sem sanitização adequada, permitindo que um atacante injete código ou comandos maliciosos que serão executados com as permissões da aplicação. O risco é crítico porque o atacante passa a controlar a lógica de execução.

Ejemplo

Um login que monta a query SQL como `SELECT * FROM users WHERE email = '` + email_usuario + `'` permite que um atacante envie `admin@mail.com' OR '1'='1` e contorne autenticação. Ou um script que executa `system('ping ' + host_externo)` deixa aberto para injetar `; rm -rf /` e deletar arquivos.

Cómo mitigar

Use prepared statements (queries parametrizadas) para banco de dados, escape adequado para sistema operacional, e valide entrada contra um whitelist restrito. Nunca confie em concatenação de strings para montar comandos dinâmicos.

CVE-2024-39906HIGHRemote code execution in Haven IndieAuthClient (GHSL-2024-093)EPSS 1.0%CVE-2022-29166HIGHImproper handling of multiline messages in matrix-appservice-ircEPSS 1.0%CVE-2025-24364HIGHvaultwarden allows RCE in the admin panelEPSS 1.0%CVE-2025-2729HIGHH3C Magic BE18000 HTTP POST Request networkSetup command injectionEPSS 1.0%CVE-2025-2730HIGHH3C Magic BE18000 HTTP POST Request getssidname command injectionEPSS 1.0%CVE-2025-2728HIGHH3C Magic NX30 Pro/Magic NX400 getNetworkConf command injectionEPSS 1.0%CVE-2025-2731HIGHH3C Magic BE18000 HTTP POST Request getDualbandSync command injectionEPSS 1.0%CVE-2024-12484MEDIUMCodezips Technical Discussion Forum signuppost.php sql injectionEPSS 1.0%CVE-2024-47180HIGHShields.io Remote Code Execution vulnerability in Dynamic JSON/TOML/YAML badgesEPSS 1.0%CVE-2020-26293MEDIUMPossible XSS bypass if style tag is allowedEPSS 1.0%CVE-2026-18613CRITICALGL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injectionEPSS 1.0%CVE-2023-6648MEDIUMPHPGurukul Nipah Virus Testing Management System password-recovery.php sql injectionEPSS 1.0%CVE-2021-21316MEDIUMArbitrary code execution in less-openui5EPSS 1.0%CVE-2025-4467MEDIUMSourceCodester Online Student Clearance System edit-admin.php sql injectionEPSS 1.0%CVE-2023-39424CRITICALImproper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in RDPngFileUpload.dllEPSS 1.0%CVE-2025-0396HIGHexelban stats XPC Service shouldAcceptNewConnection command injectionEPSS 1.0%CVE-2022-31593—SAP Business One client - version 10.0 allows an attacker with low privileges, to inject code that can be executed by the application. An atEPSS 1.0%CVE-2025-3008MEDIUMNovastar CX40 NetFilter Utility netconfig popen command injectionEPSS 1.0%CVE-2024-11591MEDIUM1000 Projects Beauty Parlour Management System add-services.php sql injectionEPSS 1.0%CVE-2024-23830HIGHMantisBT Host Header Injection vulnerabilityEPSS 1.0%