Weaknesses of type CWE-94
4,864 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2024-44466CRITICALCOMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub_424CB4. Attackers can send POST request messages to /usr/bin/weEPSS 10.7%CVE-2026-27577CRITICALn8n: Expression Sandbox Escape Leads to RCEEPSS 10.7%CVE-2022-41223MEDIUMThe Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injecEPSS 10.7%KEVCVE-2017-16082—A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column EPSS 10.4%CVE-2025-1302CRITICALVersions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attEPSS 10.4%CVE-2025-58176HIGHDive's improper processing of custom urls can lead to Remote Code ExecutionEPSS 10.0%CVE-2025-57773HIGHDataease DB2 Aspectweaver Deserialization Arbitrary File Write VulnerabilityEPSS 9.7%CVE-2026-1560HIGHCustom Block Builder – Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code ExecutionEPSS 9.4%CVE-2026-58138CRITICALOrkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script EvaluatorsEPSS 9.1%CVE-2024-21534CRITICALAll versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can EPSS 9.0%CVE-2025-1392MEDIUMD-Link DIR-816 index.html cross site scriptingEPSS 8.7%CVE-2026-41179CRITICALRClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command executionEPSS 8.6%CVE-2022-35649—The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter EPSS 8.6%CVE-2026-65660HIGHMicrosoft SharePoint Server Remote Code Execution VulnerabilityEPSS 8.2%KEVCVE-2022-36963HIGHSolarWinds Platform Deserialization of Untrusted Data VulnerabilityEPSS 8.2%CVE-2024-28848HIGHSpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadataEPSS 7.9%CVE-2024-0252HIGHRemote code executionEPSS 7.8%CVE-2019-14867HIGHA flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way thEPSS 7.4%CVE-2026-3584CRITICALKali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_processEPSS 7.4%CVE-2024-25110CRITICALAzure IoT Platform Device SDK Remote Code Execution VulnerabilityEPSS 7.3%