Weaknesses of type CWE-95
196 resultsInjeção em código avaliado dinamicamente (Eval Injection)
Ocorre quando a aplicação executa código dinamicamente (via eval, exec ou equivalente) sem neutralizar entrada do usuário. Um atacante injeta comandos maliciosos que são interpretados como código legítimo, permitindo execução arbitrária com os privilégios da aplicação.
Example
Um formulário web recebe um nome de usuário e executa `eval('var nome = "' + inputUsuario + '"')`. Se o usuário injetar `"; malware(); "`, a string malformada executa a função malware com controle total da aplicação.
How to mitigate
Evite eval, exec e similares — use alternativas seguras (JSON.parse em vez de eval para dados, ou templates parametrizados). Se for inevitável usar avaliação dinâmica, valide e escape rigorosamente a entrada, e considere sandbox ou permissões restritivas.
CVE-2023-7101HIGHArbitrary Code Execution (ACE) VulnerabilityEPSS 19.1%KEVCVE-2025-0868CRITICALRemote Code Execution in DocsGPTEPSS 17.1%CVE-2026-22666HIGHDolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()EPSS 15.5%CVE-2025-54322CRITICALXspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py. The EPSS 15.1%CVE-2026-0863HIGHSandbox escape in n8n Python task runner allows for arbitrary code execution on the underlying host.EPSS 9.4%CVE-2025-64496HIGHOpen WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE EventsEPSS 7.8%CVE-2026-39932CRITICALOpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() InjectionEPSS 3.7%CVE-2013-10051CRITICALInstantCMS <= 1.6 Remote PHP Code ExecutionEPSS 2.8%CVE-2021-33678MEDIUMA function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75AEPSS 2.5%CVE-2025-48868HIGHHorilla vulnerable to authenticated RCE via eval() in project_bulk_archiveEPSS 2.5%CVE-2019-9507HIGHThe web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to arbitrary remote code executionEPSS 2.2%CVE-2024-45846HIGHAn arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integrationEPSS 2.1%CVE-2024-31996CRITICALXWiki Commons missing escaping of `{` in Velocity escapetool allows remote code executionEPSS 2.1%CVE-2020-6650HIGHArbitrary code execution through “Update Manager” ClassEPSS 2.1%CVE-2020-5256HIGHRemote Code Execution Through Image Uploads in BookStackEPSS 2.0%CVE-2026-48273CRITICALColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)EPSS 1.9%CVE-2020-5217MEDIUMDirective injection when using dynamic overrides with user input in RubyGems secure_headersEPSS 1.8%CVE-2026-19295CRITICALLangflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcementEPSS 1.8%CVE-2023-50447HIGHPillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2EPSS 1.7%CVE-2023-37909CRITICALPrivilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheetEPSS 1.6%