Weaknesses of type CWE-94
4,891 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2022-41158HIGHeyoom builder Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-25967HIGHVersions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variableEPSS 2.1%CVE-2022-24663CRITICALRemote Code Execution by Subscriber+ users via WordPress shortcodeEPSS 2.1%CVE-2023-22506HIGHThis High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of BambooEPSS 2.1%CVE-2024-48840CRITICALUnauthorized AccessEPSS 2.1%CVE-2024-39962CRITICALD-Link DIR-823X AX3000 Dual-Band Gigabit Wireless Router v21_D240126 was discovered to contain a remote code execution (RCE) vulnerability iEPSS 2.1%CVE-2026-59861HIGHKiota: Code Generation Literal Injection in Kiota Ruby GeneratorEPSS 2.0%CVE-2020-8132—Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructEPSS 2.0%CVE-2025-70328HIGHTOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost handler of the /usr/sbin/shttpEPSS 2.0%CVE-2021-32836HIGHPre-auth unsafe deserialization in ZStackEPSS 2.0%CVE-2022-3394HIGHWP All Export Pro < 1.7.9 - Authenticated Code InjectionEPSS 2.0%CVE-2020-5259HIGHPrototype Pollution in DojoxEPSS 2.0%CVE-2024-22188HIGHTYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the priEPSS 2.0%CVE-2020-8149—Lack of output sanitization allowed an attack to execute arbitrary shell commands via the logkitty npm package before version 0.7.1.EPSS 2.0%CVE-2022-34714HIGHWindows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityEPSS 2.0%CVE-2025-3472MEDIUMOcean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 2.0%CVE-2026-18937CRITICALBroken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable InjectionEPSS 2.0%CVE-2024-27622HIGHA remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. This vEPSS 2.0%CVE-2026-24105CRITICALAn issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi. The value of `v1` was not checked, potentially leadEPSS 2.0%CVE-2024-56278CRITICALWordPress WP Ultimate Exporter plugin <= 2.9.1 - Remote Code Execution (RCE) vulnerabilityEPSS 2.0%