Weaknesses of type CWE-94
4,891 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-27876CRITICALRCE on Grafana via sqlExpressionsEPSS 2.0%CVE-2013-10057HIGHSynactis PDF In-The-Box ConnectToSynactic Stack-Based Buffer OverflowEPSS 2.0%CVE-2021-29465HIGHRemote file overwrite on discord-recon can result in DoS and Remote Code ExecutionEPSS 2.0%CVE-2023-36437HIGHAzure DevOps Server Remote Code Execution VulnerabilityEPSS 2.0%CVE-2023-34112MEDIUMJavaCPP project actions vulnerable to code injection EPSS 1.9%CVE-2021-24312—WP Super Cache < 1.7.3 - Authenticated Remote Code ExecutionEPSS 1.9%CVE-2023-23477HIGHIBM WebSphere Application Server code executionEPSS 1.9%CVE-2022-3242MEDIUMHTML code Injection in template search keyword in microweber/microweberEPSS 1.9%CVE-2022-44087CRITICALESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component UPFILE_PIC_ZOOM_HIGHT.EPSS 1.9%CVE-2022-44089CRITICALESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component IS_GETCACHE.EPSS 1.9%CVE-2025-34061CRITICALPHPStudy 2016-2018 Backdoor Remote Code Execution VulnerabilityEPSS 1.9%CVE-2021-32673HIGHRemote Command Execution in reg-keygen-git-hash-pluginEPSS 1.9%CVE-2024-6345HIGHRemote Code Execution in pypa/setuptoolsEPSS 1.9%CVE-2025-30911CRITICALWordPress RomethemeKit For Elementor plugin <= 1.5.4 - Arbitrary Plugin Installation/Activation to RCE vulnerabilityEPSS 1.9%CVE-2025-65294CRITICALAqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechaniEPSS 1.9%CVE-2021-39159CRITICALRemote code execution in BinderhubEPSS 1.9%CVE-2021-4434CRITICALSocial Warfare <= 3.5.2 - Remote Code ExecutionEPSS 1.9%CVE-2024-31822CRITICALAn issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitraryEPSS 1.9%CVE-2023-46226CRITICALApache IoTDB: Remote Code Execution (RCE) risk via the UDFEPSS 1.9%CVE-2026-33937CRITICALHandlebars.js has JavaScript Injection via AST Type ConfusionEPSS 1.9%