Weaknesses of type CWE-94
4,443 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2023-36859HIGHPiiGAB M-Bus Code InjectionEPSS 0.8%CVE-2025-54063HIGHCherry Studio One-click Remote Code Execution Vulnerability through Custom URL HandlingEPSS 0.8%CVE-2026-26045HIGHMoodle: moodle: improper validation in file restore functionality leading to remote code executionEPSS 0.8%CVE-2025-5396CRITICALBears Backup <= 2.0.0 - Unauthenticated Remote Code ExecutionEPSS 0.8%CVE-2026-33622MEDIUMA PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript ExecutionEPSS 0.8%CVE-2026-54612HIGHVvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-globalEPSS 0.8%CVE-2024-12652CRITICALIntumit SmartRobot′s Conversational AI Platform - Improper Control of Generation of Code ('Code Injection')EPSS 0.8%CVE-2024-11034HIGHRequest a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation <= 1.4 - Unauthenticated Arbitrary Shortcode Execution via fire_contact_formEPSS 0.8%CVE-2023-49001CRITICALAn issue in Indi Browser (aka kvbrowser) v.12.11.23 allows an attacker to bypass intended access restrictions via interaction with the com.eEPSS 0.8%CVE-2019-25468CRITICALNetGain EM Plus 10.1.68 Remote Code Execution via script_test.jspEPSS 0.8%CVE-2025-57141CRITICALrsbi-os 4.7 is vulnerable to Remote Code Execution (RCE) in sqlite-jdbc.EPSS 0.8%CVE-2025-58159CRITICALWeGIA Authenticated Arbitrary File Upload Leading To Remote Code Execution (RCE)EPSS 0.8%CVE-2025-58745CRITICALWeGIA has a bypass for the fix for CVE-2025-22133 - Arbitrary File Upload leads to Remote Code Execution (RCE)EPSS 0.8%CVE-2025-29281HIGHIn PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitraryEPSS 0.8%CVE-2024-40446CRITICALAn issue in forkosh Mime Tex before v.1.77 allows an attacker to execute arbitrary code via a crafted scriptEPSS 0.8%CVE-2020-36870CRITICALRuijie Gateway EG & NBR Models v11.1(6)B9P1 - 11.9(4)B12P1 RCEEPSS 0.8%CVE-2024-31380CRITICALWordPress Oxygen plugin <= 4.9 - Authenticated Remote Code Execution (RCE) vulnerabilityEPSS 0.8%CVE-2025-60785HIGHA remote code execution (RCE) vulnerability in the Postgres Drivers component of iceScrum v7.54 Pro On-prem allows attackers to execute arbiEPSS 0.8%CVE-2024-0325LOWCommand Injection in Helix SyncEPSS 0.8%CVE-2024-0755HIGHMemory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed evidence of memory corruptionEPSS 0.8%