Fallos del tipo CWE-94

4442 resultados

Injeção de script

A aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados pelo servidor ou navegador como se fossem parte legítima do programa.

Ejemplo

Um formulário de contato concatena o nome do usuário diretamente em um script JavaScript enviado ao navegador: `<script>var usuario = '` + entrada_usuario + `';</script>`. Se o usuário envia `'; alert('xss'); //`, o navegador executa o alerta indesejado.

Cómo mitigar

Nunca construa código dinâmico a partir de entrada de usuário. Use APIs seguras (como `JSON.parse()` ao invés de `eval()`, ou templates com escape automático), valide e sanitize rigorosamente todas as entradas, e aplique listas brancas de caracteres permitidos quando possível.

CVE-2026-43997CRITICALvm2: Sandbox EscapeEPSS 0.8%CVE-2025-49013CRITICALWilderForge vulnerable to code Injection via GitHub Actions WorkflowsEPSS 0.8%CVE-2024-52899HIGHIBM Data Virtualization Manager code executionEPSS 0.8%CVE-2026-44006CRITICALvm2: Sandbox EscapeEPSS 0.8%CVE-2024-57707CRITICALAn issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components.EPSS 0.8%CVE-2024-39669CRITICALIn the Console in Soffid IAM before 3.5.39, necessary checks were not applied to some Java objects. A malicious agent could possibly executeEPSS 0.8%CVE-2025-29401CRITICALAn arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execute arbitrary code viaEPSS 0.8%CVE-2024-51367CRITICALAn arbitrary file upload vulnerability in the component \Users\username.BlackBoard of BlackBoard v2.0.0.2 allows attackers to execute arbitrEPSS 0.8%CVE-2026-36340HIGHAn issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email functionEPSS 0.8%CVE-2024-35315MEDIUMA vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.2EPSS 0.8%CVE-2026-22686CRITICALSandbox Escape via Host Error Prototype Chain in enclave-vmEPSS 0.8%CVE-2026-4681CRITICALCritical Remote Code Execution vulnerability reported in WindchillEPSS 0.8%CVE-2025-10097MEDIUMSimStudioAI sim route.ts code injectionEPSS 0.8%CVE-2026-54237CRITICALWavelog: Unauthenticated Remote Code ExecutionEPSS 0.8%CVE-2024-11697HIGHWhen handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialogEPSS 0.8%CVE-2024-40495HIGHA vulnerability was discovered in Linksys Router E2500 with firmware 2.0.00, allows authenticated attackers to execute arbitrary code via thEPSS 0.8%CVE-2026-39881MEDIUMVim Ex command injection in Vims NetBeans integrationEPSS 0.8%CVE-2024-37821HIGHAn arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitraEPSS 0.8%CVE-2025-26260HIGHPlenti <= 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as jEPSS 0.8%CVE-2025-54063HIGHCherry Studio One-click Remote Code Execution Vulnerability through Custom URL HandlingEPSS 0.8%