Weaknesses of type CWE-94
4,455 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-44888CRITICALUnauthenticated RCE via Python Config File Injection in SaveConfigFile() (Interger)EPSS 0.6%CVE-2026-30887CRITICALOneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCEEPSS 0.6%CVE-2026-57811CRITICALWordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerabilityEPSS 0.6%CVE-2024-54448HIGHRemote Code Execution (RCE) via Automation ScriptingEPSS 0.6%CVE-2023-34330HIGHCode injection via Dynamic Redfish Extension interfaceEPSS 0.6%CVE-2026-77077HIGHn8n before 1.123.69 Remote Code Execution via EventEmitter Prototype PollutionEPSS 0.6%CVE-2025-30085CRITICALExtension - rsjoomla.com - Remote code execution vulnerability in RSForm!pro component 3.0.0 - 3.3.14 for JoomlaEPSS 0.6%CVE-2024-52959CRITICALiota C.ai Conversational Platform - Improper Control of Generation of Code ('Code Injection')EPSS 0.6%CVE-2026-1929HIGHAdvanced Woo Labels <= 2.37 - Authenticated (Contributor+) Remote Code Execution via 'callback' ParameterEPSS 0.6%CVE-2025-66224CRITICALOrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter InjectionEPSS 0.6%CVE-2025-41717HIGHConfig-Upload Code InjectionEPSS 0.6%CVE-2023-39445—Hidden functionality vulnerability in LAN-WH300N/RE all versions provided by LOGITEC CORPORATION allows an unauthenticated attacker to execuEPSS 0.6%CVE-2024-27859HIGHThe issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionEPSS 0.6%CVE-2024-13472HIGHWooCommerce Product Table Lite <= 3.9.4 - Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site ScriptingEPSS 0.6%CVE-2026-39891HIGHPraisonAI has a Template Injection in Agent Tool DefinitionsEPSS 0.6%CVE-2026-28797HIGHRAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" ComponentEPSS 0.6%CVE-2017-20251CRITICALWordPress Insert PHP Plugin 4.7.0 PHP Code Injection via REST APIEPSS 0.6%CVE-2024-55504MEDIUMAn issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially leading to remote coEPSS 0.6%CVE-2024-13495HIGHGamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_ajax_get_logs FunctionEPSS 0.6%CVE-2025-53836CRITICALXWiki Rendering is vulnerable to RCE attacks when processing nested macrosEPSS 0.6%