Weaknesses of type CWE-94

4,891 results

Injeção de script

Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.

Example

Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.

How to mitigate

Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.

CVE-2023-45590CRITICALAn improper control of generation of code ('code injection') in Fortinet FortiClientLinux version 7.2.0, 7.0.6 through 7.0.10 and 7.0.3 throEPSS 1.5%CVE-2025-11837HIGHMalware RemoverEPSS 1.5%CVE-2025-63706CRITICALNPM package next-npm-version1.0.1 is vulnerable to Command injection.EPSS 1.5%CVE-2022-46333HIGHProofpoint Enterprise Protection perl eval() arbitrary command executionEPSS 1.5%CVE-2024-10950HIGHCode Injection in binary-husky/gpt_academicEPSS 1.5%CVE-2024-10954HIGHPrompt Injection Leading to RCE in binary-husky/gpt_academic Plugin `manim`EPSS 1.5%CVE-2024-31004HIGHAn issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4StsdAtom.cpp,AP4_StsdAtom::AP4_StsdAtom,mEPSS 1.5%CVE-2024-21673HIGHThis High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center and Server. RemoteEPSS 1.5%CVE-2023-26817HIGHcodefever before 2023.2.7-commit-b1c2e7f was discovered to contain a remote code execution (RCE) vulnerability via the component /controllerEPSS 1.5%CVE-2022-46157HIGHRemote php code execution in Akeneo PIMEPSS 1.5%CVE-2018-0461MEDIUMCisco IP Phone 8800 Series Arbitrary Script Injection VulnerabilityEPSS 1.5%CVE-2021-36800HIGHAkaunting OS Command Injection in 'Money.php'EPSS 1.5%CVE-2024-31003HIGHBuffer Overflow vulnerability in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the AP4_MemoryByteStream::WEPSS 1.5%CVE-2022-36386CRITICALWordPress Import any XML or CSV File to WordPress plugin <= 3.6.7 - Authenticated Arbitrary Code Execution vulnerabilityEPSS 1.5%CVE-2024-55022HIGHWeintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain an authenticated command injection vulnerability via the HMI NamEPSS 1.5%CVE-2023-5221MEDIUMForU CMS index.php code injectionEPSS 1.5%CVE-2024-51941HIGHApache Ambari: Remote Code Injection in Ambari Metrics and AMS AlertsEPSS 1.5%CVE-2026-86596CRITICALs2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN ParameterEPSS 1.5%CVE-2023-51066HIGHAn authenticated remote code execution vulnerability in QStar Archive Solutions Release RELEASE_3-0 Build 7 Patch 0 allows attackers to arbiEPSS 1.5%CVE-2024-38395CRITICALIn iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is noEPSS 1.5%