Weaknesses of type CWE-95
196 resultsInjeção em código avaliado dinamicamente (Eval Injection)
Ocorre quando a aplicação executa código dinamicamente (via eval, exec ou equivalente) sem neutralizar entrada do usuário. Um atacante injeta comandos maliciosos que são interpretados como código legítimo, permitindo execução arbitrária com os privilégios da aplicação.
Example
Um formulário web recebe um nome de usuário e executa `eval('var nome = "' + inputUsuario + '"')`. Se o usuário injetar `"; malware(); "`, a string malformada executa a função malware com controle total da aplicação.
How to mitigate
Evite eval, exec e similares — use alternativas seguras (JSON.parse em vez de eval para dados, ou templates parametrizados). Se for inevitável usar avaliação dinâmica, valide e escape rigorosamente a entrada, e considere sandbox ou permissões restritivas.
CVE-2023-30537CRITICALorg.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalationEPSS 1.0%CVE-2023-29511CRITICALxwiki-platform-administration-ui vulnerable to privilege escalationEPSS 1.0%CVE-2025-66474HIGHXWiki vulnerable to remote code execution through insufficient protection against {{/html}} injectionEPSS 1.0%CVE-2023-35152CRITICALXWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResultsEPSS 1.0%CVE-2025-8420HIGHMultiple Plugins by emarket-design <= Multiple Versions - Unauthenticated Limited Remote Code ExecutionEPSS 1.0%CVE-2022-41928CRITICALXWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xmlEPSS 1.0%CVE-2024-8512CRITICALW3SPEEDSTER <= 7.26 - Authenticated (Administrator+) Remote Code ExecutionEPSS 1.0%CVE-2026-46562CRITICALYamcs: Remote Code Execution via Mission Database algorithm overrideEPSS 1.0%CVE-2021-23277HIGHImproper Neutralization of Directives in Dynamically Evaluated CodeEPSS 1.0%CVE-2026-19780HIGHKoha Eval Code Injection Remote Code Execution VulnerabilityEPSS 1.0%CVE-2024-6891HIGHJournyx Authenticated Remote Code ExecutionEPSS 1.0%CVE-2025-4318CRITICALInput validation issue in AWS Amplify Studio UI component propertiesEPSS 0.9%CVE-2026-40187HIGHAuthenticated RCE via Malicious eTemplate Upload in EGroupwareEPSS 0.9%CVE-2026-76190HIGHColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)EPSS 0.9%CVE-2026-65643HIGHEval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.EPSS 0.9%CVE-2022-38193MEDIUMCode injection issue in Portal for ArcGIS (10.7.1 and 10.8.1)EPSS 0.9%CVE-2026-73601CRITICALFlowise before 3.1.3 Remote Code Execution via Custom MCPEPSS 0.9%CVE-2025-50187CRITICALChamilo: Evaluation of untrusted user input leads to Remote Code ExecutionEPSS 0.9%CVE-2024-45851HIGHAn arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePointEPSS 0.9%CVE-2024-45850HIGHAn arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePointEPSS 0.9%