Weaknesses of type CWE-94
4,431 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2024-48514CRITICALphp-heic-to-jpg <= 1.0.5 is vulnerable to code injection (fixed in 1.0.6). An attacker who can upload heic images is able to execute code onEPSS 1.0%CVE-2026-42898CRITICALMicrosoft Dynamics 365 On-Premises Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-18245MEDIUMIncomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-reactEPSS 1.0%CVE-2026-77908HIGHMicrosoft Dynamics 365 On-Premises Remote Code Execution VulnerabilityEPSS 1.0%CVE-2024-6602CRITICALMemory corruption in NSSEPSS 1.0%CVE-2023-46243CRITICALCode execution via the edit action in XWiki platformEPSS 1.0%CVE-2025-3641HIGHMoodle: authenticated remote code execution risk in the moodle lms dropbox repositoryEPSS 1.0%CVE-2026-30308CRITICALIn its design for automatic terminal command execution, HAI Build Code Generator offers two options: Execute safe commands and Execute all cEPSS 1.0%CVE-2023-23645CRITICALWordPress MainWP Code Snippets Extension Plugin <= 4.0.2 - Subscriber+ Arbitrary PHP Code Injection/Execution VulnerabilityEPSS 1.0%CVE-2026-30306CRITICALIn its design for automatic terminal command execution, SakaDev offers two options: Execute safe commands and execute all commands. The descEPSS 1.0%CVE-2026-8931CRITICALCritical RCE vulnerability in Disig Web SignerEPSS 1.0%CVE-2025-65294CRITICALAqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechaniEPSS 1.0%CVE-2026-29091HIGHLocutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code InjectionEPSS 1.0%CVE-2022-0845HIGHCode Injection in pytorchlightning/pytorch-lightningEPSS 1.0%CVE-2024-46489HIGHA remote command execution (RCE) vulnerability in promptr v6.0.7 allows attackers to execute arbitrary commands via a crafted URL.EPSS 1.0%CVE-2026-46562CRITICALYamcs: Remote Code Execution via Mission Database algorithm overrideEPSS 1.0%CVE-2026-30694CRITICALAn issue in DedeCMS v.5.7.118 and before allows a remote attacker to execute arbitrary code via the array_filter componentEPSS 1.0%CVE-2024-53924CRITICALPycel through 1.0b30, when operating on an untrusted spreadsheet, allows code execution via a crafted formula in a cell, such as one beginniEPSS 1.0%CVE-2014-10065—Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing forEPSS 1.0%CVE-2026-53597HIGHPrompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loaderEPSS 1.0%