Weaknesses of type CWE-94
4,891 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2024-6825HIGHRemote Code Execution in BerriAI/litellmEPSS 1.7%CVE-2023-2859HIGH Code Injection in nilsteampassnet/teampassEPSS 1.6%CVE-2022-39326HIGHkartverket/github-workflows's run-terraform allows for RCE via terraform planEPSS 1.6%CVE-2024-37287CRITICALKibana arbitrary code execution via prototype pollutionEPSS 1.6%CVE-2024-42739HIGHIn TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setAccessDeviceCEPSS 1.6%CVE-2022-26112CRITICALPinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function supportEPSS 1.6%CVE-2024-10958HIGHWP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelayEPSS 1.6%CVE-2023-27867MEDIUMIBM Db2 code executionEPSS 1.6%CVE-2023-1773MEDIUMRockoa Configuration File webmainConfig.php code injectionEPSS 1.6%CVE-2022-44262CRITICALff4j 1.8.1 is vulnerable to Remote Code Execution (RCE).EPSS 1.6%CVE-2023-27868MEDIUMIBM Db2 code executionEPSS 1.6%CVE-2023-27869MEDIUMIBM Db2 code executionEPSS 1.6%CVE-2022-39424HIGHVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are PriorEPSS 1.6%CVE-2023-51784CRITICALApache InLong: Remote Code Execution vulnerability in Apache InLong ManagerEPSS 1.6%CVE-2023-46480CRITICALAn issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter oEPSS 1.6%CVE-2023-5550MEDIUMMoodle: rce due to lfi risk in some misconfigured shared hosting environmentsEPSS 1.6%CVE-2023-29963HIGHS-CMS v5.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /admin/ajax.php.EPSS 1.6%CVE-2024-30565HIGHAn issue was discovered in SeaCMS version 12.9, allows remote attackers to execute arbitrary code via admin notify.php.EPSS 1.6%CVE-2022-40497HIGHWazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code execution (RCE) vulneraEPSS 1.6%CVE-2024-27972CRITICALWordPress WP Fusion Lite plugin <= 3.41.24 - Remote Code Execution (RCE) vulnerabilityEPSS 1.6%