Weaknesses of type CWE-94
4,402 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-27966CRITICALLangflow has Remote Code Execution in CSV AgentEPSS 33.7%CVE-2022-40871CRITICALDolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarrEPSS 33.4%CVE-2024-29276CRITICALAn issue was discovered in seeyonOA version 8, allows remote attackers to execute arbitrary code via the importProcess method in WorkFlowDesEPSS 32.8%CVE-2020-8218HIGHA code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code eEPSS 32.7%KEVCVE-2013-3129HIGHMicrosoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5; Silverlight 5 before 5.1.20513.0; win32k.sys in the kernel-mode drivers, and GDI+,EPSS 32.4%CVE-2023-0048HIGH Code Injection in lirantal/daloradiusEPSS 32.3%CVE-2009-2512CRITICALThe Web Services on Devices API (WSDAPI) in Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 does not properly process the headEPSS 31.2%CVE-2021-29440HIGHTwig allowing dangerous PHP functions by defaultEPSS 30.6%CVE-2023-6016CRITICALH2O Remote Code Execution via POJO Model ImportEPSS 30.6%CVE-2024-21351HIGHWindows SmartScreen Security Feature Bypass VulnerabilityEPSS 30.3%KEVCVE-2021-31181HIGHMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 30.0%CVE-2024-55661HIGHLaravel Pulse Allows Remote Code Execution via Unprotected Query MethodEPSS 29.5%CVE-2019-1150HIGHMicrosoft Graphics Remote Code Execution VulnerabilityEPSS 28.9%CVE-2022-31161CRITICALRoxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert UploadEPSS 28.4%CVE-2012-0014HIGHMicrosoft .NET Framework 2.0 SP2, 3.5.1, and 4, and Silverlight 4 before 4.1.10111, does not properly restrict access to memory associated wEPSS 28.2%CVE-2023-36177CRITICALAn issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information EPSS 27.5%CVE-2010-0492HIGHUse-after-free vulnerability in mstime.dll in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via vectors reEPSS 27.5%CVE-2024-25415HIGHA remote code execution (RCE) vulnerability in /admin/define_language.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP EPSS 27.2%CVE-2007-5775CRITICALUnspecified vulnerability in BitDefender allows attackers to execute arbitrary code via unspecified vectors, aka EEYEB-20071024. NOTE: as oEPSS 26.9%CVE-2025-59536HIGHClaude Code's startup trust dialog could lead to Command Execution attackEPSS 26.4%