Weaknesses of type CWE-94
4,442 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-86076HIGHn8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript ExecutionEPSS 0.8%CVE-2024-55028CRITICALA template injection vulnerability in the Dashboard of NASA Fprime v3.4.3 allows attackers to execute arbitrary code via uploading a craftedEPSS 0.8%CVE-2026-32276HIGHConnect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study PluginEPSS 0.8%CVE-2023-50029CRITICALPHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers EPSS 0.8%CVE-2026-23852MEDIUMSiYuan vulnerable to Stored XSS / RCE via `setBlockAttrs` icon attributeEPSS 0.8%CVE-2024-6596CRITICALEndress+Hauser: Multiple products are vulnerable to code injectionEPSS 0.8%CVE-2026-33940HIGHHandlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partialEPSS 0.8%CVE-2017-1002152—Bodhi 2.9.0 and lower is vulnerable to cross-site scripting resulting in code injection caused by incorrect validation of bug titles.EPSS 0.8%CVE-2024-13808HIGHXpro Elementor Addons - Pro <= 1.4.9 - Authenticated (Contributor+) Remote Code ExecutionEPSS 0.8%CVE-2026-84645HIGHIn Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level confiEPSS 0.8%CVE-2026-59543CRITICALWordPress Advanced Views plugin <= 3.8.11 - Remote Code Execution (RCE) vulnerabilityEPSS 0.8%CVE-2026-65548CRITICALWordPress Betheme theme <= 28.4.2 - Remote Code Execution (RCE) vulnerabilityEPSS 0.8%CVE-2026-73992CRITICALWordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerabilityEPSS 0.8%CVE-2023-50810MEDIUMIn certain Sonos products before Sonos S1 Release 11.12 and S2 release 15.9, a vulnerability exists in the U-Boot component of the firmware EPSS 0.8%CVE-2026-54823CRITICALWordPress Widget Options plugin <= 4.2.3 - Remote Code Execution (RCE) vulnerabilityEPSS 0.8%CVE-2026-32444CRITICALWordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerabilityEPSS 0.8%CVE-2026-45558CRITICALRoxy-WI: Authenticated RCE on every managed HAProxy load balancer via `option` field config injection in section saveEPSS 0.8%CVE-2026-40783CRITICALWordPress Blocksy Companion Pro plugin <= 2.1.37 - Remote Code Execution (RCE) vulnerabilityEPSS 0.8%CVE-2022-38946CRITICALArbitrary File Upload vulnerability in Doctor-Appointment version 1.0 in /Frontend/signup_com.php, allows attackers to execute arbitrary codEPSS 0.8%CVE-2025-30013MEDIUMCode Injection vulnerability in SAP ERP BW Business ContentEPSS 0.8%