Weaknesses of type CWE-94
4,891 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-85978CRITICALUnauthenticated Remote Code Execution in Akana API PlatformEPSS 1.4%CVE-2021-22646HIGHOvarro TBox Code InjectionEPSS 1.4%CVE-2024-24780CRITICALApache IoTDB: Remote Code Execution with untrusted URI of User-defined functionEPSS 1.4%CVE-2024-42599HIGHSeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_files.php imposes restrictioEPSS 1.4%CVE-2022-48093HIGHSeacms v12.7 was discovered to contain a remote code execution (RCE) vulnerability via the ip parameter at admin_ ip.php.EPSS 1.4%CVE-2023-46010—An issue in SeaCMS v.12.9 allows an attacker to execute arbitrary commands via the admin_safe.php component.EPSS 1.4%CVE-2022-45908CRITICALIn PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on a user-supplied winsEPSS 1.4%CVE-2026-6875CRITICALSandbox Escape in ServiceNow AI PlatformEPSS 1.4%CVE-2026-83627CRITICALHummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug LogEPSS 1.4%CVE-2024-33871HIGHAn issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver lEPSS 1.4%CVE-2026-88062CRITICALOmniRoute ACP Custom-Agent Remote Code Execution (RCE)EPSS 1.4%CVE-2022-47318HIGHruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a reposEPSS 1.4%CVE-2023-21553HIGHAzure DevOps Server Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-25502CRITICALDirectory Traversal vulnerability in flusity CMS v.2.4 allows a remote attacker to execute arbitrary code and obtain sensitive information vEPSS 1.4%CVE-2026-58655HIGHGrav Flex Objects - Server-Side Template Injection via Dynamic TitlesEPSS 1.4%CVE-2023-30130HIGHAn issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.EPSS 1.4%CVE-2022-48116HIGHAyaCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/tpl_edit.inc.php.EPSS 1.4%CVE-2022-46648HIGHruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a reposEPSS 1.4%CVE-2024-23208HIGHThe issue was addressed with improved memory handling. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOEPSS 1.4%CVE-2026-59866CRITICALKiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceNameEPSS 1.4%