Weaknesses of type CWE-829

317 results

Inclusão de funcionalidade de esfera de controle não confiável

Ocorre quando o software importa, carrega ou executa código, bibliotecas ou componentes originários de uma fonte não confiável ou não verificada. O atacante consegue injetar funcionalidade maliciosa que rodará com os mesmos privilégios da aplicação, comprometendo a integridade e segurança do sistema.

Example

Uma aplicação web baixa dinamicamente um plugin ou módulo de um servidor externo sem validar assinatura criptográfica ou integridade. Um atacante intercepta ou compromete o servidor de origem e substitui o arquivo legítimo por uma versão maliciosa; a aplicação carrega e executa o código comprometido automaticamente.

How to mitigate

Valide sempre a origem, autenticidade e integridade de componentes antes de carregá-los: use assinatura digital criptográfica, checksums verificados, HTTPS com pinning de certificado e, quando possível, evite carregamento dinâmico. Mantenha inventário atualizado de dependências e aplique patches regularmente.

CVE-2026-108913HIGHomarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarcEPSS 0.4%CVE-2025-59828HIGHClaude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn VersionsEPSS 0.4%CVE-2026-43944CRITICALelecterm: dangerous code can be run through links or command lineEPSS 0.4%CVE-2026-87114HIGHKube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudoEPSS 0.4%CVE-2026-6464HIGHPostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commandsEPSS 0.4%CVE-2025-67842MEDIUMThe Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via the subdomainEPSS 0.4%CVE-2026-18408HIGHPostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql clientEPSS 0.4%CVE-2025-53546CRITICALFolo allows secrets exfiltration via `pull_request_target`EPSS 0.3%CVE-2026-26079MEDIUMRoundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled.EPSS 0.3%CVE-2026-78019HIGHDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Functionality from Untrusted ControEPSS 0.3%CVE-2023-31170MEDIUM Inclusion of Functionality from Untrusted Control SphereEPSS 0.3%CVE-2026-15519LOWusestrix PyPI system_prompt.jinja inclusion of functionality from untrusted control sphereEPSS 0.3%CVE-2026-84725HIGHOpenjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eapEPSS 0.3%CVE-2023-5523HIGHM-Files Web Companion allows Remote Code ExecutionEPSS 0.3%CVE-2026-63277HIGHRCE via calcext:data-mappings, sql provider and jdbc connectorEPSS 0.3%CVE-2026-114488HIGHWildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport bindingEPSS 0.3%CVE-2026-97150HIGHWhen converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP cEPSS 0.3%CVE-2026-32920HIGHOpenClaw < 2026.3.12 - Arbitrary Code Execution via Auto-Discovery of Workspace PluginsEPSS 0.3%CVE-2026-73367HIGHWordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerabilityEPSS 0.3%CVE-2026-28500HIGHONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain AttackEPSS 0.3%