Weaknesses of type CWE-94
4,422 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2022-39365CRITICALRCE vulnerability in Pimcore/Mail & Dynamic Text LayoutEPSS 1.8%CVE-2022-21686CRITICALServer Side Twig Template Injection in PrestaShopEPSS 1.8%CVE-2024-47051CRITICALRemote Code Execution & File Deletion in Asset UploadsEPSS 1.8%CVE-2023-29861CRITICALAn issue found in FLIR-DVTEL version not specified allows a remote attacker to execute arbitrary code via a crafted request to the managemenEPSS 1.8%CVE-2024-39864CRITICALApache CloudStack: Integration API service uses dynamic port when disabledEPSS 1.8%CVE-2021-23814MEDIUMThis affects versions of the package unisharp/laravel-filemanager before 2.6.2. The upload() function does not sufficiently validate the filEPSS 1.8%CVE-2024-21674HIGHThis High severity Remote Code Execution (RCE) vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server.
Remote EPSS 1.8%CVE-2024-29937CRITICALNFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitraryEPSS 1.8%CVE-2024-1015CRITICALRemote command execution vulnerability in SE-elektronic GmbH E-DDC3.3EPSS 1.8%CVE-2022-45928HIGHA remote OScript execution issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). Multiple endpoints allow the user toEPSS 1.7%CVE-2022-48175CRITICALRukovoditel v3.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the component /rukovoditel/index.php?module=dashEPSS 1.7%CVE-2006-7105CRITICALPHP remote file inclusion vulnerability in libs/Smarty.class.php in Smarty 2.6.9 allows remote attackers to execute arbitrary PHP code via aEPSS 1.7%CVE-2023-34237HIGHRemote code execution via specially crafted script settings in SABnzbdEPSS 1.7%CVE-2023-39059—An issue in ansible semaphore v.2.8.90 allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables paramEPSS 1.7%CVE-2021-39160CRITICALCode injection in nbgitpullerEPSS 1.7%CVE-2024-39877HIGHApache Airflow: DAG Author Code Execution possibility in airflow-schedulerEPSS 1.7%CVE-2021-22961—A code injection vulnerability exists within the firewall software of GlassWire v2.1.167 that could lead to arbitrary code execution from a EPSS 1.7%CVE-2022-35767HIGHWindows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityEPSS 1.7%CVE-2022-35766HIGHWindows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityEPSS 1.7%CVE-2021-24430—Speed Booster Pack 4.2.0-beta - Authenticated (admin+) RCEEPSS 1.7%