Weaknesses of type CWE-94
4,442 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-43997CRITICALvm2: Sandbox EscapeEPSS 0.8%CVE-2025-49013CRITICALWilderForge vulnerable to code Injection via GitHub Actions WorkflowsEPSS 0.8%CVE-2024-52899HIGHIBM Data Virtualization Manager code executionEPSS 0.8%CVE-2026-44006CRITICALvm2: Sandbox EscapeEPSS 0.8%CVE-2024-57707CRITICALAn issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components.EPSS 0.8%CVE-2024-39669CRITICALIn the Console in Soffid IAM before 3.5.39, necessary checks were not applied to some Java objects. A malicious agent could possibly executeEPSS 0.8%CVE-2025-29401CRITICALAn arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execute arbitrary code viaEPSS 0.8%CVE-2024-51367CRITICALAn arbitrary file upload vulnerability in the component \Users\username.BlackBoard of BlackBoard v2.0.0.2 allows attackers to execute arbitrEPSS 0.8%CVE-2026-36340HIGHAn issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email functionEPSS 0.8%CVE-2024-35315MEDIUMA vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.2EPSS 0.8%CVE-2026-22686CRITICALSandbox Escape via Host Error Prototype Chain in enclave-vmEPSS 0.8%CVE-2026-4681CRITICALCritical Remote Code Execution vulnerability reported in WindchillEPSS 0.8%CVE-2025-10097MEDIUMSimStudioAI sim route.ts code injectionEPSS 0.8%CVE-2026-54237CRITICALWavelog: Unauthenticated Remote Code ExecutionEPSS 0.8%CVE-2024-11697HIGHWhen handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialogEPSS 0.8%CVE-2024-40495HIGHA vulnerability was discovered in Linksys Router E2500 with firmware 2.0.00, allows authenticated attackers to execute arbitrary code via thEPSS 0.8%CVE-2026-39881MEDIUMVim Ex command injection in Vims NetBeans integrationEPSS 0.8%CVE-2024-37821HIGHAn arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitraEPSS 0.8%CVE-2025-26260HIGHPlenti <= 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as jEPSS 0.8%CVE-2025-54063HIGHCherry Studio One-click Remote Code Execution Vulnerability through Custom URL HandlingEPSS 0.8%