Weaknesses of type CWE-94
4,892 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-12866CRITICALAll versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScrEPSS 0.9%CVE-2026-38165CRITICALA Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows atEPSS 0.9%CVE-2026-27745HIGHSPIP interface_traduction_objets < 2.2.2 Authenticated RCEEPSS 0.9%CVE-2025-67489CRITICAL@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development serverEPSS 0.9%CVE-2025-49013CRITICALWilderForge vulnerable to code Injection via GitHub Actions WorkflowsEPSS 0.9%CVE-2025-66457HIGHElysia affected by arbitrary code injection through cookie configEPSS 0.9%CVE-2023-37424HIGHUnauthenticated Remote Code Execution in EdgeConnect SD-WAN Orchestrator Web-Based Management InterfaceEPSS 0.9%CVE-2026-78463HIGHRemote Desktop Client Remote Code Execution VulnerabilityEPSS 0.9%CVE-2024-39236CRITICALGradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py. This vulnerability is tEPSS 0.9%CVE-2023-21890CRITICALVulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Core). Supported versiEPSS 0.9%CVE-2024-48138CRITICALA remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows atEPSS 0.9%CVE-2025-13592HIGHAdvanced Ads <= 2.0.14 - Authenticated (Editor+) Remote Code Execution via ShortcodeEPSS 0.9%CVE-2026-72765HIGHn8n before 2.32.1 Remote Code Execution via Expression Sandbox EscapeEPSS 0.9%CVE-2026-18162CRITICALIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.9%CVE-2026-73343CRITICALWordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerabilityEPSS 0.9%CVE-2026-62104CRITICALWordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerabilityEPSS 0.9%CVE-2019-25468CRITICALNetGain EM Plus 10.1.68 Remote Code Execution via script_test.jspEPSS 0.9%CVE-2026-67926CRITICALAn issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat ModuleEPSS 0.9%CVE-2026-16051CRITICALWPMU DEV Dashboard < 5.0.1 - Remote Code Execution via Hub Install ActionEPSS 0.9%CVE-2026-81204CRITICALLangflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guardsEPSS 0.9%