Weaknesses of type CWE-94
4,400 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-34197HIGHApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeansEPSS 98.3%KEVCVE-2022-22947CRITICALIn spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway ActuatEPSS 98.3%KEVCVE-2021-39144HIGHXStream is vulnerable to a Remote Command Execution attackEPSS 98.1%KEVCVE-2023-25717CRITICALRuckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLoginEPSS 98.1%KEVCVE-2023-6553CRITICALBackup Migration <= 1.3.7 - Unauthenticated Remote Code ExecutionEPSS 97.8%CVE-2024-56145CRITICALRCE when PHP `register_argc_argv` config setting is enabled in craftcms/cmsEPSS 97.4%KEVCVE-2025-54068CRITICALLivewire vulnerable to remote command execution during property update hydrationEPSS 97.1%KEVCVE-2018-1273CRITICALSpring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerabilitEPSS 97.0%KEVCVE-2023-33246CRITICALApache RocketMQ: Possible remote code execution vulnerability when using the update configuration functionEPSS 96.6%KEVCVE-2009-1151CRITICALStatic code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to injeEPSS 96.6%KEVCVE-2026-33017CRITICALLangflow has Unauthenticated Remote Code Execution via Public Flow Build EndpointEPSS 96.2%KEVCVE-2023-0297CRITICAL Code Injection in pyload/pyloadEPSS 95.9%CVE-2023-49070—Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still presentEPSS 95.4%CVE-2019-7609CRITICALKibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the EPSS 95.3%KEVCVE-2019-10173HIGHIt was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framEPSS 95.0%CVE-2024-9264CRITICALGrafana SQL Expressions allow for remote code executionEPSS 94.9%CVE-2017-9822HIGHDNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN siteEPSS 94.8%KEVCVE-2023-41892CRITICALCraft CMS Remote Code Execution vulnerabilityEPSS 94.2%CVE-2024-45507HIGHApache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCEEPSS 93.2%CVE-2020-8243HIGHA vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template toEPSS 90.8%KEV