Fallos del tipo CWE-94

4847 resultados

Injeção de script

A aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados pelo servidor ou navegador como se fossem parte legítima do programa.

Ejemplo

Um formulário de contato concatena o nome do usuário diretamente em um script JavaScript enviado ao navegador: `<script>var usuario = '` + entrada_usuario + `';</script>`. Se o usuário envia `'; alert('xss'); //`, o navegador executa o alerta indesejado.

Cómo mitigar

Nunca construa código dinâmico a partir de entrada de usuário. Use APIs seguras (como `JSON.parse()` ao invés de `eval()`, ou templates com escape automático), valide e sanitize rigorosamente todas as entradas, e aplique listas brancas de caracteres permitidos quando possível.

CVE-2026-3584CRITICALKali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_processEPSS 7.2%CVE-2025-23061CRITICALMongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue existEPSS 7.2%CVE-2026-23523CRITICALDive allows One-click Remote Code Execution through Deep Links for MCP InstallEPSS 7.1%CVE-2021-36394—In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.EPSS 7.0%CVE-2024-5466HIGHRemote Code ExecutionEPSS 6.9%CVE-2026-27174CRITICALMajorDoMo Unauthenticated Remote Code Execution via Admin Console EvalEPSS 6.9%CVE-2024-55964CRITICALAn issue was discovered in Appsmith before 1.52. An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote commandEPSS 6.8%CVE-2025-61260CRITICALA vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context ProtoEPSS 6.7%CVE-2026-26216CRITICALCrawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks ParameterEPSS 6.4%CVE-2022-47879HIGHA Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classesEPSS 6.3%CVE-2026-31861HIGHShell Command Injection in Git Routes [CloudCLI UI]EPSS 6.3%CVE-2011-10019CRITICALSpreecommerce < 0.60.2 Search Parameter RCEEPSS 6.3%CVE-2026-7873CRITICALCode Injection Vulnerability in Code Validation EndpointEPSS 6.2%CVE-2017-16544HIGHIn the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of fiEPSS 6.1%CVE-2021-45029—Apache ShenYu 2.4.1 Groovy Code Injection & SpEL InjectionEPSS 6.0%CVE-2024-29201CRITICALJumpServer's insecure Ansible playbook validation leads to RCE in CeleryEPSS 6.0%CVE-2020-10055—A vulnerability has been identified in Desigo CC (V4.x), Desigo CC (V3.x), Desigo CC Compact (V4.x), Desigo CC Compact (V3.x). Affected applEPSS 6.0%CVE-2024-29202CRITICALJumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in CeleryEPSS 5.9%CVE-2016-5402HIGHA code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker wEPSS 5.9%CVE-2026-44262CRITICALScramble: Remote code execution via evaluation of user-controlled input in validation rulesEPSS 5.9%