Fallos del tipo CWE-94

4359 resultados

Injeção de script

A aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados pelo servidor ou navegador como se fossem parte legítima do programa.

Ejemplo

Um formulário de contato concatena o nome do usuário diretamente em um script JavaScript enviado ao navegador: `<script>var usuario = '` + entrada_usuario + `';</script>`. Se o usuário envia `'; alert('xss'); //`, o navegador executa o alerta indesejado.

Cómo mitigar

Nunca construa código dinâmico a partir de entrada de usuário. Use APIs seguras (como `JSON.parse()` ao invés de `eval()`, ou templates com escape automático), valide e sanitize rigorosamente todas as entradas, e aplique listas brancas de caracteres permitidos quando possível.

CVE-2021-38243CRITICALxunruicms up to v4.5.1 was discovered to contain a remote code execution (RCE) vulnerability in /index.php. This vulnerability allows attackEPSS 1.3%CVE-2022-39326HIGHkartverket/github-workflows's run-terraform allows for RCE via terraform planEPSS 1.3%CVE-2022-2636HIGHCode Injection in hestiacp/hestiacpEPSS 1.3%CVE-2025-3509HIGHPre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege EscalationEPSS 1.3%CVE-2024-6983HIGHRemote Code Execution in mudler/localaiEPSS 1.3%CVE-2024-23746CRITICALMiro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (bEPSS 1.3%CVE-2023-37427HIGHAuthenticated Remote Code Execution in EdgeConnect SD-WAN Orchestrator Web-Based Management InterfaceEPSS 1.3%CVE-2024-55022HIGHWeintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain an authenticated command injection vulnerability via the HMI NamEPSS 1.3%CVE-2007-5565CRITICALPHP remote file inclusion vulnerability in includes/functions.php in phpSCMS 0.0.1-Alpha1 allows remote attackers to execute arbitrary PHP cEPSS 1.3%CVE-2023-46947HIGHSubrion 4.2.1 has a remote command execution vulnerability in the backend.EPSS 1.3%CVE-2025-31722HIGHIn Jenkins Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders are not subject to sandbox protection, allowing attackerEPSS 1.3%CVE-2023-22889CRITICALSmartBear Zephyr Enterprise through 7.15.0 mishandles user-defined input during report generation. This could lead to remote code execution EPSS 1.3%CVE-2024-21546CRITICALVersions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetyEPSS 1.3%CVE-2025-34128HIGHX360 VideoPlayer ActiveX Control Buffer Overflow via ConvertFile()EPSS 1.3%CVE-2026-22709CRITICALvm2 has a Sandbox EscapeEPSS 1.3%CVE-2026-27493CRITICALn8n has Unauthenticated Expression Evaluation via Form NodeEPSS 1.3%CVE-2023-33472HIGHAn issue was discovered in Scada-LTS v2.7.5.2 build 4551883606 and before, allows remote attackers with low-level authentication to escalateEPSS 1.3%CVE-2024-21649HIGHRemote code execution EPSS 1.3%CVE-2021-47778HIGHGetSimple CMS My SMTP Contact Plugin 1.1.2 - PHP Code InjectionEPSS 1.3%CVE-2024-40521HIGHSeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is due to the fact that although admin_template.php imposes certainEPSS 1.3%