Weaknesses of type CWE-94
4,402 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2009-2494CRITICALThe Active Template Library (ATL) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 EPSS 42.3%CVE-2026-4257CRITICALContact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill FunctionalityEPSS 41.5%CVE-2021-22894HIGHA buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary cEPSS 41.3%KEVCVE-2023-50260HIGHWazuh's vulnerability in host_deny AR script allows arbitrary command executionEPSS 41.2%CVE-2022-0819HIGHCode Injection in dolibarr/dolibarrEPSS 41.0%CVE-2023-20209MEDIUMA vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) couEPSS 40.8%CVE-2022-0661—Ad Injection <= 1.2.0.19 - Admin+ Stored Cross-Site Scripting & RCEEPSS 40.2%CVE-2022-37155HIGHRCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.EPSS 40.0%CVE-2024-53944CRITICALAn issue was discovered on Tuoshi/Dionlink LT15D 4G Wi-Fi devices through M7628NNxlSPv2xUI_v1.0.1802.10.08_P4 and LT21B devices through M762EPSS 39.7%CVE-2026-29014CRITICALMetInfo CMS Unauthenticated PHP Code Injection RCEEPSS 39.5%CVE-2024-32030HIGHRemote code execution via JNDI resolution in JMX metrics collection in Kafka UIEPSS 39.4%CVE-2026-3300CRITICALEverest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation FieldEPSS 39.2%CVE-2023-33157HIGHMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 38.2%CVE-2009-2493HIGHThe Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 200EPSS 37.8%CVE-2024-7094CRITICALJS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.6 - Unauthenticated PHP Code Injection to Remote Code ExecutionEPSS 37.6%CVE-2009-1547HIGHUnspecified vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a cEPSS 37.4%CVE-2026-46442CRITICALFlowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox EscapeEPSS 36.3%CVE-2024-43363HIGHRemote code execution via Log Poisoning in CactiEPSS 35.6%CVE-2024-37084CRITICALCVE-2024-37084: Remote code execution in Spring Cloud Data FlowEPSS 35.2%CVE-2026-27760CRITICALOpenCATS PHP Code Injection via installer AJAX endpointEPSS 34.6%