Weaknesses of type CWE-94
4,423 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-45140CRITICALChamilo LMS CStudio upload flow allows unauthenticated remote code executionEPSS 1.3%CVE-2022-44533HIGHA vulnerability in the Aruba EdgeConnect Enterprise web management interface allows remote authenticated users to run arbitrary commands on EPSS 1.3%CVE-2024-6507HIGHDeep Lake Kaggle command injectionEPSS 1.3%CVE-2024-39331CRITICALIn Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as sEPSS 1.3%CVE-2026-37003CRITICALAgno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection. The PythonTools and ShellTools components EPSS 1.3%CVE-2022-36069HIGHPoetry Argument Injection vulnerability can lead to local Code ExecutionEPSS 1.3%CVE-2024-12729HIGHA post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older thaEPSS 1.3%CVE-2023-24676HIGHAn issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameEPSS 1.3%CVE-2025-27678CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Client Remote Code Execution V-2023EPSS 1.3%CVE-2024-21546CRITICALVersions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetyEPSS 1.3%CVE-2025-25789CRITICALFoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controller\Sitemap.php.EPSS 1.3%CVE-2024-41714HIGHA vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoice Business Solution Virtual Instance (MEPSS 1.3%CVE-2026-4327HIGHThe Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' ParameterEPSS 1.3%CVE-2023-5221MEDIUMForU CMS index.php code injectionEPSS 1.3%CVE-2024-11600HIGHBorderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.6.0 - Authenticated (Administrator+) Remote Code ExecutionEPSS 1.3%CVE-2021-38243CRITICALxunruicms up to v4.5.1 was discovered to contain a remote code execution (RCE) vulnerability in /index.php. This vulnerability allows attackEPSS 1.3%CVE-2022-39326HIGHkartverket/github-workflows's run-terraform allows for RCE via terraform planEPSS 1.3%CVE-2022-2636HIGHCode Injection in hestiacp/hestiacpEPSS 1.3%CVE-2025-3509HIGHPre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege EscalationEPSS 1.3%CVE-2026-42537CRITICALApache Ranger: Remote Code Execution via JDBC URL InjectionEPSS 1.3%