Fallos del tipo CWE-94

4891 resultados

Injeção de script

A aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados pelo servidor ou navegador como se fossem parte legítima do programa.

Ejemplo

Um formulário de contato concatena o nome do usuário diretamente em um script JavaScript enviado ao navegador: `<script>var usuario = '` + entrada_usuario + `';</script>`. Se o usuário envia `'; alert('xss'); //`, o navegador executa o alerta indesejado.

Cómo mitigar

Nunca construa código dinâmico a partir de entrada de usuário. Use APIs seguras (como `JSON.parse()` ao invés de `eval()`, ou templates com escape automático), valide e sanitize rigorosamente todas as entradas, e aplique listas brancas de caracteres permitidos quando possível.

CVE-2023-45590CRITICALAn improper control of generation of code ('code injection') in Fortinet FortiClientLinux version 7.2.0, 7.0.6 through 7.0.10 and 7.0.3 throEPSS 1.5%CVE-2025-11837HIGHMalware RemoverEPSS 1.5%CVE-2025-63706CRITICALNPM package next-npm-version1.0.1 is vulnerable to Command injection.EPSS 1.5%CVE-2022-46333HIGHProofpoint Enterprise Protection perl eval() arbitrary command executionEPSS 1.5%CVE-2024-10950HIGHCode Injection in binary-husky/gpt_academicEPSS 1.5%CVE-2024-10954HIGHPrompt Injection Leading to RCE in binary-husky/gpt_academic Plugin `manim`EPSS 1.5%CVE-2024-31004HIGHAn issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4StsdAtom.cpp,AP4_StsdAtom::AP4_StsdAtom,mEPSS 1.5%CVE-2024-21673HIGHThis High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center and Server. RemoteEPSS 1.5%CVE-2023-26817HIGHcodefever before 2023.2.7-commit-b1c2e7f was discovered to contain a remote code execution (RCE) vulnerability via the component /controllerEPSS 1.5%CVE-2022-46157HIGHRemote php code execution in Akeneo PIMEPSS 1.5%CVE-2018-0461MEDIUMCisco IP Phone 8800 Series Arbitrary Script Injection VulnerabilityEPSS 1.5%CVE-2021-36800HIGHAkaunting OS Command Injection in 'Money.php'EPSS 1.5%CVE-2024-31003HIGHBuffer Overflow vulnerability in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the AP4_MemoryByteStream::WEPSS 1.5%CVE-2022-36386CRITICALWordPress Import any XML or CSV File to WordPress plugin <= 3.6.7 - Authenticated Arbitrary Code Execution vulnerabilityEPSS 1.5%CVE-2024-55022HIGHWeintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain an authenticated command injection vulnerability via the HMI NamEPSS 1.5%CVE-2023-5221MEDIUMForU CMS index.php code injectionEPSS 1.5%CVE-2024-51941HIGHApache Ambari: Remote Code Injection in Ambari Metrics and AMS AlertsEPSS 1.5%CVE-2026-86596CRITICALs2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN ParameterEPSS 1.5%CVE-2023-51066HIGHAn authenticated remote code execution vulnerability in QStar Archive Solutions Release RELEASE_3-0 Build 7 Patch 0 allows attackers to arbiEPSS 1.5%CVE-2024-38395CRITICALIn iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is noEPSS 1.5%