Weaknesses of type CWE-94

4,442 results

Injeção de script

Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.

Example

Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.

How to mitigate

Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.

CVE-2026-23946MEDIUMTendenci has Authenticated Remote Code Execution via Pickle DeserializationEPSS 0.9%CVE-2026-25817HIGHHMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 haEPSS 0.9%CVE-2026-76224HIGHArcadeDB before 26.8.1 Remote Code Execution via Groovy FallbackEPSS 0.9%CVE-2026-86732HIGHCraft CMS before 5.10.12 Remote Code Execution via element-indexEPSS 0.9%CVE-2024-55241HIGHAn issue in deep-diver LLM-As-Chatbot before commit 99c2c03 allows a remote attacker to execute arbitrary code via the modelsbyom.py componeEPSS 0.9%CVE-2024-4662HIGHOxygen Builder <= 4.8.2 - Authenticated (Contributor+) Remote Code ExecutionEPSS 0.9%CVE-2026-50872CRITICALAn issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attackers to execute arbitrary commands and obtaEPSS 0.8%CVE-2026-8855HIGHIBM HTTP Server is affected by multiple vulnerabilitiesEPSS 0.8%CVE-2023-25054CRITICALWordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to Remote Code Execution (RCE)EPSS 0.8%CVE-2026-42090CRITICALNotesnook: RCE via stored XSS in note export renderingEPSS 0.8%CVE-2024-50611HIGHCycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as builEPSS 0.8%CVE-2025-41699HIGHPhoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllersEPSS 0.8%CVE-2024-10035CRITICALCode Injection in BG-TEK's CoslatV3EPSS 0.8%CVE-2025-62429HIGHClipBucket v5 executes arbitrary PHP codeEPSS 0.8%CVE-2026-40342CRITICALFirebird: Path Traversal + Arbitrary File Write Leads to Remote Code ExecutionEPSS 0.8%CVE-2026-41138HIGHFlowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas.EPSS 0.8%CVE-2025-5392CRITICALGB Forms DB <= 1.0.2 - Unauthenticated Remote Code ExecutionEPSS 0.8%CVE-2026-33938HIGHHandlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-blockEPSS 0.8%CVE-2026-9135CRITICALPolicies Component Dynamic CodeInput Fields Bypass Custom Component ValidationEPSS 0.8%CVE-2026-56185MEDIUMWindows Admin Center Information Disclosure VulnerabilityEPSS 0.8%