Fallos del tipo CWE-94

4442 resultados

Injeção de script

A aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados pelo servidor ou navegador como se fossem parte legítima do programa.

Ejemplo

Um formulário de contato concatena o nome do usuário diretamente em um script JavaScript enviado ao navegador: `<script>var usuario = '` + entrada_usuario + `';</script>`. Se o usuário envia `'; alert('xss'); //`, o navegador executa o alerta indesejado.

Cómo mitigar

Nunca construa código dinâmico a partir de entrada de usuário. Use APIs seguras (como `JSON.parse()` ao invés de `eval()`, ou templates com escape automático), valide e sanitize rigorosamente todas as entradas, e aplique listas brancas de caracteres permitidos quando possível.

CVE-2026-23946MEDIUMTendenci has Authenticated Remote Code Execution via Pickle DeserializationEPSS 0.9%CVE-2026-25817HIGHHMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 haEPSS 0.9%CVE-2026-76224HIGHArcadeDB before 26.8.1 Remote Code Execution via Groovy FallbackEPSS 0.9%CVE-2026-86732HIGHCraft CMS before 5.10.12 Remote Code Execution via element-indexEPSS 0.9%CVE-2024-55241HIGHAn issue in deep-diver LLM-As-Chatbot before commit 99c2c03 allows a remote attacker to execute arbitrary code via the modelsbyom.py componeEPSS 0.9%CVE-2024-4662HIGHOxygen Builder <= 4.8.2 - Authenticated (Contributor+) Remote Code ExecutionEPSS 0.9%CVE-2026-50872CRITICALAn issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attackers to execute arbitrary commands and obtaEPSS 0.8%CVE-2026-8855HIGHIBM HTTP Server is affected by multiple vulnerabilitiesEPSS 0.8%CVE-2023-25054CRITICALWordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to Remote Code Execution (RCE)EPSS 0.8%CVE-2026-42090CRITICALNotesnook: RCE via stored XSS in note export renderingEPSS 0.8%CVE-2024-50611HIGHCycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as builEPSS 0.8%CVE-2025-41699HIGHPhoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllersEPSS 0.8%CVE-2024-10035CRITICALCode Injection in BG-TEK's CoslatV3EPSS 0.8%CVE-2025-62429HIGHClipBucket v5 executes arbitrary PHP codeEPSS 0.8%CVE-2026-40342CRITICALFirebird: Path Traversal + Arbitrary File Write Leads to Remote Code ExecutionEPSS 0.8%CVE-2026-41138HIGHFlowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas.EPSS 0.8%CVE-2025-5392CRITICALGB Forms DB <= 1.0.2 - Unauthenticated Remote Code ExecutionEPSS 0.8%CVE-2026-33938HIGHHandlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-blockEPSS 0.8%CVE-2026-9135CRITICALPolicies Component Dynamic CodeInput Fields Bypass Custom Component ValidationEPSS 0.8%CVE-2026-56185MEDIUMWindows Admin Center Information Disclosure VulnerabilityEPSS 0.8%