Weaknesses of type CWE-94
4,891 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2023-29861CRITICALAn issue found in FLIR-DVTEL version not specified allows a remote attacker to execute arbitrary code via a crafted request to the managemenEPSS 1.8%CVE-2024-39864CRITICALApache CloudStack: Integration API service uses dynamic port when disabledEPSS 1.8%CVE-2024-21674HIGHThis High severity Remote Code Execution (RCE) vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server.
Remote EPSS 1.8%CVE-2006-7105CRITICALPHP remote file inclusion vulnerability in libs/Smarty.class.php in Smarty 2.6.9 allows remote attackers to execute arbitrary PHP code via aEPSS 1.8%CVE-2026-66147CRITICALAn unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which alloEPSS 1.8%CVE-2024-29937CRITICALNFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitraryEPSS 1.8%CVE-2023-44011CRITICALAn issue in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the layout.master skin file at tEPSS 1.8%CVE-2024-1015CRITICALRemote command execution vulnerability in SE-elektronic GmbH E-DDC3.3EPSS 1.8%CVE-2026-0322HIGHPAN-OS: Authenticated Remote Code Execution (RCE) in the Management InterfaceEPSS 1.7%KEVCVE-2023-34237HIGHRemote code execution via specially crafted script settings in SABnzbdEPSS 1.7%CVE-2023-39059—An issue in ansible semaphore v.2.8.90 allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables paramEPSS 1.7%CVE-2022-36006HIGHAuthenticated remote code execution due to insecure deserialization (GHSL-2022-063)EPSS 1.7%CVE-2021-39160CRITICALCode injection in nbgitpullerEPSS 1.7%CVE-2022-46161CRITICALCode injection in pdfmakeEPSS 1.7%CVE-2024-39877HIGHApache Airflow: DAG Author Code Execution possibility in airflow-schedulerEPSS 1.7%CVE-2021-22961—A code injection vulnerability exists within the firewall software of GlassWire v2.1.167 that could lead to arbitrary code execution from a EPSS 1.7%CVE-2022-25812—Transposh WordPress Translation < 1.0.8 - Admin+ RCEEPSS 1.7%CVE-2021-24430—Speed Booster Pack 4.2.0-beta - Authenticated (admin+) RCEEPSS 1.7%CVE-2025-14287HIGHCommand Injection in mlflow/mlflowEPSS 1.7%CVE-2024-31666CRITICALAn issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via a crafted script to the edit_addon_post.php component.EPSS 1.7%