Weaknesses of type CWE-94
4,402 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-27577CRITICALn8n: Expression Sandbox Escape Leads to RCEEPSS 10.0%CVE-2026-26026CRITICALGLPI has a Server-Side Template Injection via Double-CompilationEPSS 9.6%CVE-2025-57772HIGHDataease H2 JDBC RCE BypassEPSS 9.3%CVE-2026-58138CRITICALOrkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script EvaluatorsEPSS 9.3%CVE-2024-21534CRITICALAll versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can EPSS 9.0%CVE-2026-1560HIGHCustom Block Builder – Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code ExecutionEPSS 8.9%CVE-2022-35649—The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter EPSS 8.7%CVE-2026-41179CRITICALRClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command executionEPSS 8.6%CVE-2025-57773HIGHDataease DB2 Aspectweaver Deserialization Arbitrary File Write VulnerabilityEPSS 8.3%CVE-2025-58176HIGHDive's improper processing of custom urls can lead to Remote Code ExecutionEPSS 8.2%CVE-2022-36963HIGHSolarWinds Platform Deserialization of Untrusted Data VulnerabilityEPSS 8.2%CVE-2025-1392MEDIUMD-Link DIR-816 index.html cross site scriptingEPSS 8.0%CVE-2024-28848HIGHSpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadataEPSS 7.9%CVE-2024-0252HIGHRemote code executionEPSS 7.8%CVE-2026-0768CRITICALLangflow code Code Injection Remote Code Execution VulnerabilityEPSS 7.8%CVE-2019-14867HIGHA flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way thEPSS 7.4%CVE-2025-23061CRITICALMongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue existEPSS 7.3%CVE-2026-3584CRITICALKali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_processEPSS 7.2%CVE-2024-25110CRITICALAzure IoT Platform Device SDK Remote Code Execution VulnerabilityEPSS 7.2%CVE-2026-23523CRITICALDive allows One-click Remote Code Execution through Deep Links for MCP InstallEPSS 7.2%