Weaknesses of type CWE-95
196 resultsInjeção em código avaliado dinamicamente (Eval Injection)
Ocorre quando a aplicação executa código dinamicamente (via eval, exec ou equivalente) sem neutralizar entrada do usuário. Um atacante injeta comandos maliciosos que são interpretados como código legítimo, permitindo execução arbitrária com os privilégios da aplicação.
Example
Um formulário web recebe um nome de usuário e executa `eval('var nome = "' + inputUsuario + '"')`. Se o usuário injetar `"; malware(); "`, a string malformada executa a função malware com controle total da aplicação.
How to mitigate
Evite eval, exec e similares — use alternativas seguras (JSON.parse em vez de eval para dados, ou templates parametrizados). Se for inevitável usar avaliação dinâmica, valide e escape rigorosamente a entrada, e considere sandbox ou permissões restritivas.
CVE-2024-45849HIGHAn arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePointEPSS 0.9%CVE-2024-45847HIGHAn arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integratiEPSS 0.9%CVE-2024-45848HIGHAn arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integrationEPSS 0.9%CVE-2026-44128CRITICALUnauthenticated Remote Code ExecutionEPSS 0.8%CVE-2026-73602CRITICALFlowise before 3.1.3 Sandbox Escape to RCEEPSS 0.8%CVE-2026-35002CRITICALAgno < 2.3.24 field_type Eval Injection Arbitrary Code ExecutionEPSS 0.8%CVE-2024-39173CRITICALcalculator-boilerplate v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the eval function at /routes/calculatoEPSS 0.8%CVE-2025-55728CRITICALXWiki Remote Macros vulnerable to remote code execution using the panel macroEPSS 0.8%CVE-2026-64193CRITICALNet::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROREPSS 0.8%CVE-2026-29091HIGHLocutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code InjectionEPSS 0.8%CVE-2026-54569CRITICALSENAITE.CORE: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') and Missing Authorization in senaite.coreEPSS 0.8%CVE-2025-49013CRITICALWilderForge vulnerable to code Injection via GitHub Actions WorkflowsEPSS 0.8%CVE-2026-28370CRITICALIn the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger codEPSS 0.8%CVE-2026-1665MEDIUMCommand Injection in nvm via NVM_AUTH_HEADER in wget code pathEPSS 0.7%CVE-2023-48699HIGHfastbots Eval Injection vulnerabilityEPSS 0.7%CVE-2023-0090CRITICALProofpoint Enterprise Protection webservices unauthenticated RCEEPSS 0.7%CVE-2023-0089HIGHProofpoint Enterprise Protection webutils authenticated RCEEPSS 0.7%CVE-2026-4001CRITICALWoocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing FormulaEPSS 0.7%CVE-2025-31114CRITICALFooocus webui vulnerable to Remote Code ExecutionEPSS 0.7%CVE-2025-27603CRITICALXWiki Confluence Migrator Pro allows Remote Code Execution via unescaped translationsEPSS 0.7%