Weaknesses of type CWE-94
4,892 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2024-45623CRITICALD-Link DAP-2310 Hardware A Firmware 1.16RC028 allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the ATPEPSS 0.9%CVE-2025-5309HIGHRemote Support & Privileged Remote Access server side template injectionEPSS 0.9%CVE-2024-41368CRITICALRPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWlanIpMail.phpEPSS 0.9%CVE-2024-41361CRITICALRPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\manageFilesFolders.phpEPSS 0.9%CVE-2024-41364CRITICALRPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\trackEdit.phpEPSS 0.9%CVE-2024-41369CRITICALRPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWifi.phpEPSS 0.9%CVE-2024-41366CRITICALRPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\userScripts.phpEPSS 0.9%CVE-2024-41367CRITICALRPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\api\playlist\appendFileToPlaylist.pEPSS 0.9%CVE-2024-50704CRITICALUnauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code vEPSS 0.9%CVE-2024-31022CRITICALAn issue was discovered in CandyCMS version 1.0.0, allows remote attackers to execute arbitrary code via the install.php component.EPSS 0.9%CVE-2024-29399HIGHAn issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a crEPSS 0.9%CVE-2024-22633CRITICALSetor Informatica Sistema Inteligente para Laboratorios (S.I.L.) 388 was discovered to contain a remote code execution (RCE) vulnerability vEPSS 0.9%CVE-2026-87964HIGHProduct Feed Manager for WooCommerce <= 8.0.26 - Authenticated (Shop Manager+) PHP Code Injection via eval() via 'feedConfigCustom2' ParameterEPSS 0.9%CVE-2025-29806MEDIUMMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.9%CVE-2021-32834HIGHArbitrary Groovy script evaluation in Eclipse KetiEPSS 0.9%CVE-2024-30973HIGHAn issue in V-SOL G/EPON ONU HG323AC-B with firmware version V2.0.08-210715 allows an attacker to execute arbtirary code and obtain sensitivEPSS 0.9%CVE-2025-13780CRITICALRemote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)EPSS 0.9%CVE-2025-3776HIGHVerification SMS with TargetSMS <= 1.5 - Unauthenticated Limited Remote Code ExecutionEPSS 0.9%CVE-2026-85694CRITICALLaVague 0.2.35 Remote Code Execution via eval extractionEPSS 0.9%CVE-2025-54593HIGHFreshRSS is vulnerable to RCE attacks by authenticated adminEPSS 0.9%