Weaknesses of type CWE-94
4,402 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2012-0175HIGHThe Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and WindEPSS 26.1%CVE-2025-23121CRITICALA vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain userEPSS 26.0%CVE-2023-34990CRITICALA relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized cEPSS 24.9%CVE-2024-4884CRITICALWhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution VulnerabilityEPSS 24.3%CVE-2025-26264HIGHGeoVision GV-ASWeb with the version 6.1.2.0 or less (fixed in 6.2.0), contains a Remote Code Execution (RCE) vulnerability within its NotifiEPSS 23.0%CVE-2025-5120HIGHSandbox Escape Vulnerability in huggingface/smolagentsEPSS 22.8%CVE-2023-46042—An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo().EPSS 22.6%CVE-2025-23209HIGHPotential RCE with a compromised security key in craft/cmsEPSS 21.8%KEVCVE-2025-55346CRITICALUnintended dynamic code execution leads to remote code execution by network attackersEPSS 20.8%CVE-2022-44088CRITICALESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component INPUT_ISDESCRIPTION.EPSS 20.1%CVE-2021-1585HIGHCisco Adaptive Security Device Manager Remote Code Execution VulnerabilityEPSS 20.0%CVE-2024-42448CRITICALFrom the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform RemEPSS 19.9%CVE-2012-1879HIGHMicrosoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code EPSS 19.6%CVE-2009-2529HIGHMicrosoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not properly handle argument validation for unspecified variables, which allowEPSS 19.5%CVE-2024-20359MEDIUMA vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco AdapEPSS 19.4%KEVCVE-2024-0195MEDIUMspider-flow FunctionController.java FunctionService.saveFunction code injectionEPSS 19.4%CVE-2010-1260HIGHThe IE8 Developer Toolbar in Microsoft Internet Explorer 8 SP1, SP2, and SP3 allows user-assisted remote attackers to execute arbitrary codeEPSS 19.1%CVE-2022-0811—A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cEPSS 19.0%CVE-2025-32583CRITICALWordPress PDF 2 Post Plugin <= 2.4.0 - Remote Code Execution (RCE) vulnerabilityEPSS 19.0%CVE-2020-7012—Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker witEPSS 18.2%