Fallos del tipo CWE-94

4891 resultados

Injeção de script

A aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados pelo servidor ou navegador como se fossem parte legítima do programa.

Ejemplo

Um formulário de contato concatena o nome do usuário diretamente em um script JavaScript enviado ao navegador: `<script>var usuario = '` + entrada_usuario + `';</script>`. Se o usuário envia `'; alert('xss'); //`, o navegador executa o alerta indesejado.

Cómo mitigar

Nunca construa código dinâmico a partir de entrada de usuário. Use APIs seguras (como `JSON.parse()` ao invés de `eval()`, ou templates com escape automático), valide e sanitize rigorosamente todas as entradas, e aplique listas brancas de caracteres permitidos quando possível.

CVE-2026-17581HIGHWCPOS <= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template EngineEPSS 1.4%CVE-2024-30923CRITICALSQL Injection vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the where Clause in Racer DocuEPSS 1.4%CVE-2024-5651HIGHFence-agents-remediation: fence agent command line options leads to remote code executionEPSS 1.4%CVE-2024-31807CRITICALTOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the hostTime parameter in thEPSS 1.4%CVE-2023-36014HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-21672HIGHThis High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center and Server. Remote CEPSS 1.4%CVE-2022-2636HIGHCode Injection in hestiacp/hestiacpEPSS 1.4%CVE-2006-5610CRITICALPHP remote file inclusion vulnerability in player/includes/common.php in Teake Nutma Foing, as modified in Fully Modded phpBB (phpbbfm) 2021EPSS 1.4%CVE-2026-58449CRITICALtxtai - Unauthenticated Remote Code Execution via Unsafe Reflection in API /reindex function ParameterEPSS 1.4%CVE-2025-71389CRITICALCal.com before 5.9.9 Remote Code Execution via RSCEPSS 1.4%CVE-2024-33445CRITICALAn issue in hisiphp v2.0.111 allows a remote attacker to execute arbitrary code via a crafted script to the SystemPlugins::mkInfo parameter EPSS 1.3%CVE-2023-37470CRITICALMetabase vulnerable to remote code execution via POST /api/setup/validate API endpoint EPSS 1.3%CVE-2022-43416HIGHJenkins Katalon Plugin 1.0.32 and earlier implements an agent/controller message that does not limit where it can be executed and allows invEPSS 1.3%CVE-2020-15171MEDIUMUsers with SCRIPT rights can execute arbitrary code in XWikiEPSS 1.3%CVE-2025-25675CRITICALTenda AC10 V1.0 V15.03.06.23 has a command injection vulnerablility located in the formexeCommand function. The str variable receives the cmEPSS 1.3%CVE-2023-42374CRITICALAn issue in mystenlabs Sui Blockchain before v.1.6.3 allow a remote attacker to execute arbitrary code and cause a denial of service via a cEPSS 1.3%CVE-2024-11600HIGHBorderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.6.0 - Authenticated (Administrator+) Remote Code ExecutionEPSS 1.3%CVE-2023-35034—Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow reEPSS 1.3%CVE-2022-45907CRITICALIn PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely.EPSS 1.3%CVE-2023-36718HIGHMicrosoft Virtual Trusted Platform Module Remote Code Execution VulnerabilityEPSS 1.3%