Weaknesses of type CWE-94
4,448 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2025-55733CRITICALDeepChat One-click Remote Code Execution through Custom URL HandlingEPSS 0.7%CVE-2026-31861HIGHShell Command Injection in Git Routes [CloudCLI UI]EPSS 0.7%CVE-2026-33414MEDIUMPowerShell Command Injection in Podman HyperV MachineEPSS 0.7%CVE-2026-89274CRITICALWP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment ContentEPSS 0.7%CVE-2025-3164MEDIUMTencent Music Entertainment SuperSonic H2 Database Connection testConnect code injectionEPSS 0.7%CVE-2024-27793MEDIUMThe issue was addressed with improved checks. This issue is fixed in iTunes 12.13.2 for Windows. Parsing a file may lead to an unexpected apEPSS 0.7%CVE-2025-26970CRITICALWordPress Ark Theme Core plugin < 1.71.0 - Unauthenticated Remote Code Execution (RCE) vulnerabilityEPSS 0.7%CVE-2026-65941HIGHWhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.EPSS 0.7%CVE-2026-55511CRITICALYamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`EPSS 0.7%CVE-2026-3352HIGHEasy PHP Settings <= 1.0.4 - Authenticated (Administrator+) PHP Code Injection via 'wp_memory_limit' SettingEPSS 0.7%CVE-2024-39017CRITICALagreejs shared v0.0.1 was discovered to contain a prototype pollution via the function mergeInternalComponents. This vulnerability allows atEPSS 0.7%CVE-2024-44430CRITICALSQL Injection vulnerability in Best Free Law Office Management Software-v1.0 allows an attacker to execute arbitrary code and obtain sensitiEPSS 0.7%CVE-2026-4327HIGHThe Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' ParameterEPSS 0.7%CVE-2026-17633HIGHLangflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handlingEPSS 0.7%CVE-2020-7381MEDIUMCode Injection in Rapid7 Nexpose InstallerEPSS 0.7%CVE-2026-17624HIGHLangflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handlingEPSS 0.7%CVE-2024-10572HIGHDenial of Service and Arbitrary File Write in h2oai/h2o-3EPSS 0.7%CVE-2025-0618MEDIUMA malicious third party could invoke a persistent denial of service vulnerability in FireEye EDR agent by sending a specially-crafted tamperEPSS 0.7%CVE-2024-25918CRITICALWordPress InstaWP Connect plugin <= 0.1.0.8 - Remote Code Execution vulnerabilityEPSS 0.7%CVE-2026-44336CRITICALPraisonAI MCP `tools/call` path-traversal and RCE via Python `.pth` injectionEPSS 0.7%