Weaknesses of type CWE-94

4,422 results

Injeção de script

Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.

Example

Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.

How to mitigate

Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.

CVE-2024-25249CRITICALAn issue in He3 App for macOS version 2.0.17, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArEPSS 1.5%CVE-2024-25301HIGHRedaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via the component /pages/templates.php.EPSS 1.5%CVE-2025-34433CRITICALAVideo < 20.1 Unauthenticated RCE via Predictable Installation SaltEPSS 1.5%CVE-2022-46166HIGHSpring Boot Admins integrated notifier support allows arbitrary code executionEPSS 1.5%CVE-2023-25539HIGH Dell NetWorker 19.6.1.2, contains an OS command injection Vulnerability in the NetWorker client. A remote unauthenticated attacker could poEPSS 1.5%CVE-2024-11635CRITICALWordPress File Upload <= 4.24.12 - Unuathenticated Remote Code ExecutionEPSS 1.5%CVE-2021-32831HIGHCode injection in total.jsEPSS 1.5%CVE-2022-39424HIGHVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are PriorEPSS 1.5%CVE-2024-28386CRITICALAn issue in Home-Made.io fastmagsync v.1.7.51 and before allows a remote attacker to execute arbitrary code via the getPhpBin() component.EPSS 1.5%CVE-2020-36655HIGHYii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can emEPSS 1.5%CVE-2022-30194HIGHWindows WebBrowser Control Remote Code Execution VulnerabilityEPSS 1.5%CVE-2024-9772HIGHUix Shortcodes – Compatible with Gutenberg <= 1.9.9 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 1.5%CVE-2022-3394HIGHWP All Export Pro < 1.7.9 - Authenticated Code InjectionEPSS 1.5%CVE-2022-36386CRITICALWordPress Import any XML or CSV File to WordPress plugin <= 3.6.7 - Authenticated Arbitrary Code Execution vulnerabilityEPSS 1.5%CVE-2025-14287HIGHCommand Injection in mlflow/mlflowEPSS 1.5%CVE-2024-44414HIGHA vulnerability was discovered in FBM_292W-21.03.10V, which has been classified as critical. This issue affects the sub_4901E0 function in tEPSS 1.5%CVE-2023-51387HIGHExpression Injection Vulnerability in HertzbeatEPSS 1.4%CVE-2022-46157HIGHRemote php code execution in Akeneo PIMEPSS 1.4%CVE-2024-51941HIGHApache Ambari: Remote Code Injection in Ambari Metrics and AMS AlertsEPSS 1.4%CVE-2023-26546HIGHEuropean Chemicals Agency IUCLID before 6.27.6 allows remote authenticated users to execute arbitrary code via Server Side Template InjectioEPSS 1.4%