Weaknesses of type CWE-94
4,359 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2023-22506HIGHThis High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of BambooEPSS 2.1%CVE-2025-29631CRITICALGardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow commandEPSS 2.1%CVE-2024-48840CRITICALUnauthorized AccessEPSS 2.1%CVE-2025-69902CRITICALA command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary comEPSS 2.1%CVE-2024-39962CRITICALD-Link DIR-823X AX3000 Dual-Band Gigabit Wireless Router v21_D240126 was discovered to contain a remote code execution (RCE) vulnerability iEPSS 2.1%CVE-2026-59861HIGHKiota: Code Generation Literal Injection in Kiota Ruby GeneratorEPSS 2.0%CVE-2022-24663CRITICALRemote Code Execution by Subscriber+ users via WordPress shortcodeEPSS 2.0%CVE-2020-8132—Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructEPSS 2.0%CVE-2016-15044CRITICALKaltura < 11.1.0-2 PHP Object Injection RCEEPSS 2.0%CVE-2020-8274—Citrix Secure Mail for Android before 20.11.0 suffers from Improper Control of Generation of Code ('Code Injection') by allowing unauthenticEPSS 2.0%CVE-2021-32836HIGHPre-auth unsafe deserialization in ZStackEPSS 2.0%CVE-2026-5562MEDIUMprovectus kafka-ui Endpoint testexecutions validateAccess code injectionEPSS 2.0%CVE-2020-5259HIGHPrototype Pollution in DojoxEPSS 2.0%CVE-2024-22188HIGHTYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the priEPSS 2.0%CVE-2026-65008CRITICALGrav before 2.0.7 Remote Code Execution via Blueprint dynamicDataEPSS 2.0%CVE-2022-45132CRITICALIn Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 temEPSS 2.0%CVE-2025-34277CRITICALNagios Log Server < 2024R1.3.1 RCE via Malformed Dashboard IDEPSS 2.0%CVE-2020-8149—Lack of output sanitization allowed an attack to execute arbitrary shell commands via the logkitty npm package before version 0.7.1.EPSS 2.0%CVE-2026-66147CRITICALAn unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which alloEPSS 2.0%CVE-2022-35777HIGHVisual Studio Remote Code Execution VulnerabilityEPSS 2.0%