Falhas do tipo CWE-94

4.455 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2026-33154HIGHdynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja ResolverEPSS 0.6%CVE-2024-10761MEDIUMUmbraco CMS Dashboard frame cross site scriptingEPSS 0.6%CVE-2025-0806MEDIUMcode-projects Job Recruitment _call_job_search_ajax.php cross site scriptingEPSS 0.6%CVE-2026-77602CRITICALOpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)EPSS 0.6%CVE-2023-43792MEDIUMbaserCMS Code Injection Vulnerability in Mail Form FeatureEPSS 0.6%CVE-2025-7887MEDIUMZavy86 WikiDocs template.inc.php cross site scriptingEPSS 0.6%CVE-2024-26362HIGHHTML injection vulnerability in Enpass Password Manager Desktop Client 6.9.2 for Windows and Linux allows attackers to run arbitrary HTML coEPSS 0.6%CVE-2026-47398HIGHPraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334EPSS 0.6%CVE-2025-4022MEDIUMweb-arena-x webarena evaluators.py HTMLContentEvaluator code injectionEPSS 0.6%CVE-2024-5834MEDIUMInappropriate implementation in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to execute arbitrary code via a craftEPSS 0.6%CVE-2026-61444CRITICALPraisonAI before 4.6.78 Code Injection via f-stringEPSS 0.6%CVE-2024-34225MEDIUMCross Site Scripting vulnerability in php-lms/admin/?page=system_info in Computer Laboratory Management System using PHP and MySQL 1.0 allowEPSS 0.6%CVE-2026-21570HIGHThis High severity RCE (Remote Code Execution)  vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0EPSS 0.6%CVE-2023-0598HIGHGE Digital Proficy Code InjectionEPSS 0.6%CVE-2024-11660MEDIUMcode-projects Farmacia usuario.php cross site scriptingEPSS 0.6%CVE-2025-66580CRITICALDive has Cross-Site Scripting vulnerability that can escalate to Remote Code ExecutionEPSS 0.6%CVE-2026-33881HIGHWindmill: Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS executorEPSS 0.6%CVE-2025-5177MEDIUMRealce Tecnologia Queue Ticket Kiosk Admin Login Page index.php cross site scriptingEPSS 0.6%CVE-2026-77414CRITICALJSONata: Arbitrary Code Execution via crafted JSONata expressionsEPSS 0.6%CVE-2024-22123LOWZabbix Arbitrary File ReadEPSS 0.6%