Fallos del tipo CWE-95

224 resultados

Injeção em Código Avaliado Dinamicamente (Eval Injection)

Fraqueza onde entrada do usuário é passada diretamente para funções que executam código dinamicamente (como eval(), exec() ou similar), sem validação ou sanitização prévia. Um atacante injeta comandos maliciosos que são interpretados e executados com os mesmos privilégios da aplicação, resultando em execução remota de código.

Ejemplo

Um aplicativo recebe uma expressão matemática do usuário via URL (ex: ?calc=2+2) e executa eval(request.param('calc')) para retornar o resultado. Um atacante envia ?calc=import('os').system('rm -rf /') e consegue executar comandos no servidor.

Cómo mitigar

Nunca use eval(), exec() ou equivalentes com entrada do usuário. Se precisa avaliar expressões, use parsers seguros ou bibliotecas de sandboxing. Valide e escape rigorosamente qualquer dado dinâmico; melhor ainda: redesenhe para evitar código dinâmico completamente.

CVE-2026-46562CRITICALYamcs: Remote Code Execution via Mission Database algorithm overrideEPSS 1.0%CVE-2024-6891HIGHJournyx Authenticated Remote Code ExecutionEPSS 1.0%CVE-2026-48317CRITICALAdobe Campaign Classic (ACC) | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)EPSS 0.9%CVE-2022-38193MEDIUMCode injection issue in Portal for ArcGIS (10.7.1 and 10.8.1)EPSS 0.9%CVE-2026-79678HIGHFreeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of serviceEPSS 0.9%CVE-2026-29091HIGHLocutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code InjectionEPSS 0.9%CVE-2026-4001CRITICALWoocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing FormulaEPSS 0.9%CVE-2025-31114CRITICALFooocus webui vulnerable to Remote Code ExecutionEPSS 0.9%CVE-2026-65643HIGHEval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.EPSS 0.9%CVE-2025-49013CRITICALWilderForge vulnerable to code Injection via GitHub Actions WorkflowsEPSS 0.9%CVE-2026-45579CRITICALDIRAC: RCE in RequestManager due to eval on untrusted inputEPSS 0.9%CVE-2024-45851HIGHAn arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePointEPSS 0.9%CVE-2024-45849HIGHAn arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePointEPSS 0.9%CVE-2024-45850HIGHAn arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePointEPSS 0.9%CVE-2026-40187HIGHAuthenticated RCE via Malicious eTemplate Upload in EGroupwareEPSS 0.9%CVE-2026-35002CRITICALAgno < 2.3.24 field_type Eval Injection Arbitrary Code ExecutionEPSS 0.9%CVE-2024-45847HIGHAn arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integratiEPSS 0.9%CVE-2026-28370CRITICALIn the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger codEPSS 0.8%CVE-2026-44128CRITICALUnauthenticated Remote Code ExecutionEPSS 0.8%CVE-2024-45848HIGHAn arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integrationEPSS 0.8%