Fallos del tipo CWE-94

4891 resultados

Injeção de script

A aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados pelo servidor ou navegador como se fossem parte legítima do programa.

Ejemplo

Um formulário de contato concatena o nome do usuário diretamente em um script JavaScript enviado ao navegador: `<script>var usuario = '` + entrada_usuario + `';</script>`. Se o usuário envia `'; alert('xss'); //`, o navegador executa o alerta indesejado.

Cómo mitigar

Nunca construa código dinâmico a partir de entrada de usuário. Use APIs seguras (como `JSON.parse()` ao invés de `eval()`, ou templates com escape automático), valide e sanitize rigorosamente todas as entradas, e aplique listas brancas de caracteres permitidos quando possível.

CVE-2026-26830CRITICALpdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and conEPSS 2.5%CVE-2026-65008CRITICALGrav before 2.0.7 Remote Code Execution via Blueprint dynamicDataEPSS 2.5%CVE-2013-10035HIGHProcessMaker Open Source < 2.5.2 neoclassic Skin PHP Code ExecutionEPSS 2.5%CVE-2026-4354MEDIUMTRENDnet TEW-824DRU Web apply_sec.cgi sub_420A78 cross site scriptingEPSS 2.5%CVE-2011-10013CRITICALTraq 2.0–2.3 admincp/common.php RCEEPSS 2.5%CVE-2022-34821HIGHA vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2), EPSS 2.5%CVE-2021-43811HIGHCode injection via unsafe YAML loadingEPSS 2.5%CVE-2024-57487MEDIUMIn Code-Projects Online Car Rental System 1.0, the file upload feature does not validate file extensions or MIME types allowing an attacker EPSS 2.5%CVE-2024-54805CRITICALNetgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updaEPSS 2.5%CVE-2024-54807CRITICALIn Netgear WNR854T 1.5.2 (North America), the UPNP service is vulnerable to command injection in the function addmap_exec which parses the NEPSS 2.5%CVE-2017-16020—Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary EPSS 2.5%CVE-2026-24107CRITICALAn issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate the value of `usbPartitionName`, which is directly used in `doSEPSS 2.5%CVE-2024-50960HIGHA command injection vulnerability in the Nmap diagnostic tool in the admin web console of Extron SMP 111 <=3.01, SMP 351 <=2.16, SMP 352 <= EPSS 2.4%CVE-2018-19011—CX-Supervisor (Versions 3.42 and prior) can execute code that has been injected into a project file. An attacker could exploit this to execuEPSS 2.4%CVE-2026-26833CRITICALthumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user iEPSS 2.4%CVE-2022-1575CRITICALArbitrary Code Execution through Sanitizer Bypass in jgraph/drawioEPSS 2.4%CVE-2024-22899HIGHVinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime funcEPSS 2.4%CVE-2022-31860CRITICALAn issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code via a crafted Groovy rule.EPSS 2.4%CVE-2016-15044CRITICALKaltura < 11.1.0-2 PHP Object Injection RCEEPSS 2.4%CVE-2024-28847HIGHSpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadataEPSS 2.4%