Fallos del tipo CWE-94

4891 resultados

Injeção de script

A aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados pelo servidor ou navegador como se fossem parte legítima do programa.

Ejemplo

Um formulário de contato concatena o nome do usuário diretamente em um script JavaScript enviado ao navegador: `<script>var usuario = '` + entrada_usuario + `';</script>`. Se o usuário envia `'; alert('xss'); //`, o navegador executa o alerta indesejado.

Cómo mitigar

Nunca construa código dinâmico a partir de entrada de usuário. Use APIs seguras (como `JSON.parse()` ao invés de `eval()`, ou templates com escape automático), valide e sanitize rigorosamente todas as entradas, e aplique listas brancas de caracteres permitidos quando possível.

CVE-2024-25249CRITICALAn issue in He3 App for macOS version 2.0.17, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArEPSS 1.5%CVE-2025-61937CRITICALAVEVA Process Optimization Code InjectionEPSS 1.5%CVE-2025-34433CRITICALAVideo < 20.1 Unauthenticated RCE via Predictable Installation SaltEPSS 1.5%CVE-2024-25301HIGHRedaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via the component /pages/templates.php.EPSS 1.5%CVE-2023-25539HIGH Dell NetWorker 19.6.1.2, contains an OS command injection Vulnerability in the NetWorker client. A remote unauthenticated attacker could poEPSS 1.5%CVE-2025-34128HIGHX360 VideoPlayer ActiveX Control Buffer Overflow via ConvertFile()EPSS 1.5%CVE-2021-32831HIGHCode injection in total.jsEPSS 1.5%CVE-2024-11635CRITICALWordPress File Upload <= 4.24.12 - Unuathenticated Remote Code ExecutionEPSS 1.5%CVE-2024-28386CRITICALAn issue in Home-Made.io fastmagsync v.1.7.51 and before allows a remote attacker to execute arbitrary code via the getPhpBin() component.EPSS 1.5%CVE-2023-40050CRITICALAutomate Vulnerable to Malicious Content Uploaded Through Embedded Compliance ApplicationEPSS 1.5%CVE-2024-9772HIGHUix Shortcodes – Compatible with Gutenberg <= 1.9.9 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 1.5%CVE-2022-42699CRITICALWordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Remote Code Execution (RCE)EPSS 1.5%CVE-2022-3418HIGHWP All Import < 3.6.9 - Admin+ Arbitrary File Upload to RCEEPSS 1.5%CVE-2023-46055—An issue in ThingNario Photon v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the pEPSS 1.5%CVE-2026-33873CRITICALLangflow has Authenticated Code Execution in Agentic Assistant ValidationEPSS 1.5%CVE-2024-44414HIGHA vulnerability was discovered in FBM_292W-21.03.10V, which has been classified as critical. This issue affects the sub_4901E0 function in tEPSS 1.5%CVE-2026-41137CRITICALFlowise: Code Injection in CSVAgent leads to Authenticated RCEEPSS 1.5%CVE-2023-51387HIGHExpression Injection Vulnerability in HertzbeatEPSS 1.4%CVE-2022-44702HIGHWindows Terminal Remote Code Execution VulnerabilityEPSS 1.4%CVE-2023-26546HIGHEuropean Chemicals Agency IUCLID before 6.27.6 allows remote authenticated users to execute arbitrary code via Server Side Template InjectioEPSS 1.4%