Weaknesses of type CWE-94
4,891 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2022-41061HIGHMicrosoft Word Remote Code Execution VulnerabilityEPSS 1.3%CVE-2026-45140CRITICALChamilo LMS CStudio upload flow allows unauthenticated remote code executionEPSS 1.3%CVE-2022-36069HIGHPoetry Argument Injection vulnerability can lead to local Code ExecutionEPSS 1.3%CVE-2024-6507HIGHDeep Lake Kaggle command injectionEPSS 1.3%CVE-2026-37003CRITICALAgno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection. The PythonTools and ShellTools components EPSS 1.3%CVE-2025-3509HIGHPre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege EscalationEPSS 1.3%CVE-2024-39331CRITICALIn Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as sEPSS 1.3%CVE-2023-24676HIGHAn issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameEPSS 1.3%CVE-2024-21546CRITICALVersions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetyEPSS 1.3%CVE-2025-27678CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Client Remote Code Execution V-2023EPSS 1.3%CVE-2026-97160CRITICALJoomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29EPSS 1.3%CVE-2025-31722HIGHIn Jenkins Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders are not subject to sandbox protection, allowing attackerEPSS 1.3%CVE-2025-25789CRITICALFoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controller\Sitemap.php.EPSS 1.3%CVE-2024-12729HIGHA post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older thaEPSS 1.3%CVE-2024-41714HIGHA vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoice Business Solution Virtual Instance (MEPSS 1.3%CVE-2020-37052CRITICALAirControl 1.4.2 - PreAuth Remote Code ExecutionEPSS 1.3%CVE-2025-53890CRITICALpyLoad vulnerable to remote code execution through js2py onCaptchaResultEPSS 1.3%CVE-2025-67113CRITICALOS command injection in the CWMP client (/ftl/bin/cwmp) of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@230804EPSS 1.3%CVE-2021-47778HIGHGetSimple CMS My SMTP Contact Plugin 1.1.2 - PHP Code InjectionEPSS 1.3%CVE-2022-50806HIGH4images 1.9 - Remote Command Execution (RCE)EPSS 1.3%