Weaknesses of type CWE-94

4,891 results

Injeção de script

Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.

Example

Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.

How to mitigate

Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.

CVE-2024-25249CRITICALAn issue in He3 App for macOS version 2.0.17, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArEPSS 1.5%CVE-2025-61937CRITICALAVEVA Process Optimization Code InjectionEPSS 1.5%CVE-2025-34433CRITICALAVideo < 20.1 Unauthenticated RCE via Predictable Installation SaltEPSS 1.5%CVE-2024-25301HIGHRedaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via the component /pages/templates.php.EPSS 1.5%CVE-2023-25539HIGH Dell NetWorker 19.6.1.2, contains an OS command injection Vulnerability in the NetWorker client. A remote unauthenticated attacker could poEPSS 1.5%CVE-2025-34128HIGHX360 VideoPlayer ActiveX Control Buffer Overflow via ConvertFile()EPSS 1.5%CVE-2021-32831HIGHCode injection in total.jsEPSS 1.5%CVE-2024-11635CRITICALWordPress File Upload <= 4.24.12 - Unuathenticated Remote Code ExecutionEPSS 1.5%CVE-2024-28386CRITICALAn issue in Home-Made.io fastmagsync v.1.7.51 and before allows a remote attacker to execute arbitrary code via the getPhpBin() component.EPSS 1.5%CVE-2023-40050CRITICALAutomate Vulnerable to Malicious Content Uploaded Through Embedded Compliance ApplicationEPSS 1.5%CVE-2024-9772HIGHUix Shortcodes – Compatible with Gutenberg <= 1.9.9 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 1.5%CVE-2022-42699CRITICALWordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Remote Code Execution (RCE)EPSS 1.5%CVE-2022-3418HIGHWP All Import < 3.6.9 - Admin+ Arbitrary File Upload to RCEEPSS 1.5%CVE-2023-46055—An issue in ThingNario Photon v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the pEPSS 1.5%CVE-2026-33873CRITICALLangflow has Authenticated Code Execution in Agentic Assistant ValidationEPSS 1.5%CVE-2024-44414HIGHA vulnerability was discovered in FBM_292W-21.03.10V, which has been classified as critical. This issue affects the sub_4901E0 function in tEPSS 1.5%CVE-2026-41137CRITICALFlowise: Code Injection in CSVAgent leads to Authenticated RCEEPSS 1.5%CVE-2023-51387HIGHExpression Injection Vulnerability in HertzbeatEPSS 1.4%CVE-2022-44702HIGHWindows Terminal Remote Code Execution VulnerabilityEPSS 1.4%CVE-2023-26546HIGHEuropean Chemicals Agency IUCLID before 6.27.6 allows remote authenticated users to execute arbitrary code via Server Side Template InjectioEPSS 1.4%