Weaknesses of type CWE-94
4,892 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2025-6000CRITICALArbitrary Remote Code Execution via Plugin Catalog AbuseEPSS 1.0%CVE-2024-8523MEDIUMlmxcms SQL Command Execution Module admin.php formatData code injectionEPSS 1.0%CVE-2023-53888HIGHZomplog 3.9 Remote Code Execution via Authenticated File ManipulationEPSS 1.0%CVE-2024-3098CRITICALPrompt Injection leading to Arbitrary Code Execution in run-llama/llama_indexEPSS 1.0%CVE-2025-48390HIGHFreeScout Vulnerable to Remote Code Execution (RCE)EPSS 1.0%CVE-2023-5500HIGHFrauscher: FDS102 for FAdC/FAdCi remote code execution vulnerabilityEPSS 1.0%CVE-2025-2710MEDIUMYonyou UFIDA ERP-NC menu.jsp cross site scriptingEPSS 1.0%CVE-2025-2711MEDIUMYonyou UFIDA ERP-NC systop.jsp cross site scriptingEPSS 1.0%CVE-2024-48453CRITICALAn issue in INOVANCE AM401_CPU1608TPTN allows a remote attacker to execute arbitrary code via the ExecuteUserProgramUpgrade functionEPSS 1.0%CVE-2023-31415CRITICALKibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send EPSS 1.0%CVE-2025-2709MEDIUMYonyou UFIDA ERP-NC login.jsp cross site scriptingEPSS 1.0%CVE-2023-30638HIGHAtos Unify OpenScape SBC 10 before 10R3.1.3, OpenScape Branch 10 before 10R3.1.2, and OpenScape BCF 10 before 10R10.7.0 allow remote authentEPSS 1.0%CVE-2023-23912HIGHA vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with tEPSS 1.0%CVE-2024-51243HIGHThe eladmin v2.7 and before contains a remote code execution (RCE) vulnerability that can control all application deployment servers of thisEPSS 1.0%CVE-2026-8634CRITICALCrabbox < v0.12.0 Environment Variable Information DisclosureEPSS 1.0%CVE-2026-15011CRITICALCustomer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' ParameterEPSS 1.0%CVE-2024-34461CRITICALZenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling codeEPSS 1.0%CVE-2024-6891HIGHJournyx Authenticated Remote Code ExecutionEPSS 1.0%CVE-2024-39209MEDIUMluci-app-sms-tool v1.9-6 was discovered to contain a command injection vulnerability via the score parameter.EPSS 1.0%CVE-2026-25755HIGHjsPDF has PDF Object Injection via Unsanitized Input in addJS MethodEPSS 1.0%