Weaknesses of type CWE-94
4,864 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2019-1150HIGHMicrosoft Graphics Remote Code Execution VulnerabilityEPSS 26.2%CVE-2012-0175HIGHThe Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and WindEPSS 26.1%CVE-2023-46042—An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo().EPSS 25.3%CVE-2025-8155MEDIUMD-Link DCS-6010L Management Application vb.htm cross site scriptingEPSS 25.3%CVE-2023-34990CRITICALA relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized cEPSS 25.0%CVE-2025-59536HIGHClaude Code's startup trust dialog could lead to Command Execution attackEPSS 24.9%CVE-2025-23121CRITICALA vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain userEPSS 24.7%CVE-2024-4884CRITICALWhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution VulnerabilityEPSS 24.3%CVE-2026-60004CRITICALGitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.EPSS 24.0%KEVCVE-2025-55346CRITICALUnintended dynamic code execution leads to remote code execution by network attackersEPSS 23.8%CVE-2025-26264HIGHGeoVision GV-ASWeb with the version 6.1.2.0 or less (fixed in 6.2.0), contains a Remote Code Execution (RCE) vulnerability within its NotifiEPSS 23.8%CVE-2024-58258HIGHSugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.EPSS 22.4%CVE-2025-23209HIGHPotential RCE with a compromised security key in craft/cmsEPSS 21.6%KEVCVE-2024-42448CRITICALFrom the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform RemEPSS 20.4%CVE-2025-32583CRITICALWordPress PDF 2 Post Plugin <= 2.4.0 - Remote Code Execution (RCE) vulnerabilityEPSS 20.3%CVE-2022-44088CRITICALESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component INPUT_ISDESCRIPTION.EPSS 20.1%CVE-2021-1585HIGHCisco Adaptive Security Device Manager Remote Code Execution VulnerabilityEPSS 20.0%CVE-2012-1879HIGHMicrosoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code EPSS 19.6%CVE-2009-2529HIGHMicrosoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not properly handle argument validation for unspecified variables, which allowEPSS 19.5%CVE-2025-8356CRITICALPath Traversal leading to RCEEPSS 19.4%