Weaknesses of type CWE-94
4,455 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2021-47938HIGHImpressCMS 1.4.2 Remote Code Execution via AutotasksEPSS 0.6%CVE-2023-41503CRITICALStudent Enrollment In PHP v1.0 was discovered to contain a SQL injection vulnerability via the Login function.EPSS 0.6%CVE-2025-45752HIGHA vulnerability in SeedDMS 6.0.32 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the zip import functiEPSS 0.6%CVE-2025-67944CRITICALWordPress Nelio AB Testing plugin <= 8.1.8 - Arbitrary Code Execution vulnerabilityEPSS 0.6%CVE-2024-44724HIGHAutoCMS v5.4 was discovered to contain a PHP code injection vulnerability via the txtsite_url parameter at /admin/site_add.php. This vulneraEPSS 0.6%CVE-2025-68952CRITICAL1-click Remote Code Execution (RCE) vulnerability in EigentEPSS 0.6%CVE-2026-20892HIGHCode injection vulnerability exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker with administrative privileges to execute arbiEPSS 0.6%CVE-2026-96757CRITICALorval before 8.29.0 Code Injection via unescaped OpenAPI media-typeEPSS 0.6%CVE-2024-21576CRITICALComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContouEPSS 0.6%CVE-2026-49493HIGHMarkdown Preview Enhanced Arbitrary Code Execution via Bitfield interpretJS()EPSS 0.6%CVE-2024-9846HIGHEnable Shortcodes inside Widgets,Comments and Experts <= 1.0.0 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.6%CVE-2024-43388HIGHPhoenix Contact: SNMP reconfiguration due to improper input validation in MGUARD devicesEPSS 0.6%CVE-2025-5137MEDIUMDedeCMS Incomplete Fix CVE-2018-9175 sys_verifies.php code injectionEPSS 0.6%CVE-2024-8479HIGHSimple Spoiler 1.2 - 1.3 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.6%CVE-2025-14324CRITICALJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.6%CVE-2024-51329HIGHA Host header injection vulnerability in Agile-Board 1.0 allows attackers to obtain the password reset token via user interaction with a craEPSS 0.6%CVE-2023-41005—An issue in Pagekit pagekit v.1.0.18 alows a remote attacker to execute arbitrary code via thedownloadAction and updateAction functions in UEPSS 0.6%CVE-2026-17561CRITICALUnauthenticated RCE in Innotim Software's Logsign SIEMEPSS 0.6%CVE-2026-54133CRITICALjmespath.php has CompilerRuntime code injection via unescaped function namesEPSS 0.6%CVE-2026-30887CRITICALOneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCEEPSS 0.6%