Weaknesses of type CWE-94
4,891 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2024-25291CRITICALDeskfiler v1.2.3 allows attackers to execute arbitrary code via uploading a crafted plugin.EPSS 1.6%CVE-2024-45200MEDIUMIn Nintendo Mario Kart 8 Deluxe before 3.0.3, the LAN/LDN local multiplayer implementation allows a remote attacker to exploit a stack-basedEPSS 1.6%CVE-2022-24512MEDIUM.NET and Visual Studio Remote Code Execution VulnerabilityEPSS 1.6%CVE-2023-32697HIGHSqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlledEPSS 1.6%CVE-2024-47208CRITICALApache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCEEPSS 1.6%CVE-2024-43469HIGHAzure CycleCloud Remote Code Execution VulnerabilityEPSS 1.6%CVE-2022-45550CRITICALAyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE).EPSS 1.6%CVE-2021-20187—It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP EPSS 1.6%CVE-2024-22116CRITICALRemote code execution within ping scriptEPSS 1.6%CVE-2026-73678CRITICALMindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec()EPSS 1.6%CVE-2024-28119HIGHGrav vulnerable to Server Side Template Injection (SSTI) via Twig escape handlerEPSS 1.6%CVE-2019-7486—Code injection in SonicWall SMA100 allows an authenticated user to execute arbitrary code in viewcacert CGI script. This vulnerability impacEPSS 1.6%CVE-2023-24059HIGHGrand Theft Auto V for PC allows attackers to achieve partial remote code execution or modify files on a PC, as exploited in the wild in JanEPSS 1.6%CVE-2021-22557MEDIUMCode execution in SLO Generator via YAML PayloadEPSS 1.6%CVE-2021-38243CRITICALxunruicms up to v4.5.1 was discovered to contain a remote code execution (RCE) vulnerability in /index.php. This vulnerability allows attackEPSS 1.6%CVE-2024-23741CRITICALAn issue in Hyper on macOS version 3.4.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnEPSS 1.6%CVE-2024-12471HIGHPost Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File UploadEPSS 1.6%CVE-2026-50871CRITICALAn OS command injection vulnerability in the media archiving and export pipeline component of kanishka-linux Reminiscence v0.3.0 allows attaEPSS 1.6%CVE-2024-37770CRITICAL14Finger v1.1 was discovered to contain a remote command execution (RCE) vulnerability in the fingerprint function. This vulnerability allowEPSS 1.6%CVE-2007-4290CRITICALMultiple PHP remote file inclusion vulnerabilities in Guestbook Script 1.9 allow remote attackers to execute arbitrary PHP code via a URL inEPSS 1.6%