Weaknesses of type CWE-94
4,497 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-40156HIGHPraisonAI Affected by Implicit Execution of Arbitrary Code via Automatic `tools.py` LoadingEPSS 0.2%CVE-2022-29819MEDIUMIn JetBrains IntelliJ IDEA before 2022.1 local code execution via links in Quick Documentation was possibleEPSS 0.2%CVE-2022-29821MEDIUMIn JetBrains Rider before 2022.1 local code execution via links in ReSharper Quick Documentation was possibleEPSS 0.2%CVE-2025-30056CRITICALCalling system commands via RunCommandEPSS 0.2%CVE-2025-11153HIGHJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.2%CVE-2025-15134MEDIUMyourmaileyes MOOC Submission MainController.java subreview cross site scriptingEPSS 0.2%CVE-2025-14228MEDIUMYealink SIP-T21P E2 Local Directory cross site scriptingEPSS 0.2%CVE-2026-91719MEDIUMCode injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.EPSS 0.2%CVE-2025-30055CRITICALConditional RCE via the "system" functionEPSS 0.2%CVE-2025-23295HIGHNVIDIA Apex for all platforms contains a vulnerability in a Python component where an attacker could cause a code injection issue by providiEPSS 0.2%CVE-2025-58673MEDIUMWordPress WP User Frontend Plugin <= 4.1.12 - Content Injection VulnerabilityEPSS 0.2%CVE-2025-33233HIGHNVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability where an attacker could cause code injection. A successful exploitEPSS 0.2%CVE-2023-34195—An issue was discovered in SystemFirmwareManagementRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The implementation of the GetEPSS 0.2%CVE-2026-44334HIGHPraisonAI: Unauthenticated RCE via `tool_override.py`EPSS 0.2%CVE-2026-40287HIGHPraisonAI has RCE via Automatic tools.py ImportEPSS 0.2%CVE-2025-53927MEDIUMMaxKB sandbox bypassEPSS 0.2%CVE-2025-14200MEDIUMalokjaiswal Hotel-Management-services-using-MYSQL-and-php Request Pending usersub.php cross site scriptingEPSS 0.2%CVE-2025-25943HIGHBuffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the AP4_Stz2Atom::AP4_Stz2Atom comEPSS 0.2%CVE-2025-4261MEDIUMGAIR-NLP factool tool.py run_single code injectionEPSS 0.2%CVE-2025-60070MEDIUMWordPress Molla - Multipurpose Responsive Shopify theme <= 1.5.13 - Arbitrary Code Execution vulnerabilityEPSS 0.2%