Falhas do tipo CWE-94

4.456 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2026-44888CRITICALUnauthenticated RCE via Python Config File Injection in SaveConfigFile() (Interger)EPSS 0.6%CVE-2026-30887CRITICALOneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCEEPSS 0.6%CVE-2026-57811CRITICALWordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerabilityEPSS 0.6%CVE-2024-54448HIGHRemote Code Execution (RCE) via Automation ScriptingEPSS 0.6%CVE-2023-34330HIGHCode injection via Dynamic Redfish Extension interfaceEPSS 0.6%CVE-2026-77077HIGHn8n before 1.123.69 Remote Code Execution via EventEmitter Prototype PollutionEPSS 0.6%CVE-2025-30085CRITICALExtension - rsjoomla.com - Remote code execution vulnerability in RSForm!pro component 3.0.0 - 3.3.14 for JoomlaEPSS 0.6%CVE-2024-52959CRITICALiota C.ai Conversational Platform - Improper Control of Generation of Code ('Code Injection')EPSS 0.6%CVE-2026-1929HIGHAdvanced Woo Labels <= 2.37 - Authenticated (Contributor+) Remote Code Execution via 'callback' ParameterEPSS 0.6%CVE-2025-66224CRITICALOrangeHRM is Vulnerable to Code Execution Through Arbitrary File Write from Sendmail Parameter InjectionEPSS 0.6%CVE-2025-41717HIGHConfig-Upload Code InjectionEPSS 0.6%CVE-2023-39445—Hidden functionality vulnerability in LAN-WH300N/RE all versions provided by LOGITEC CORPORATION allows an unauthenticated attacker to execuEPSS 0.6%CVE-2024-27859HIGHThe issue was addressed with improved memory handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, visionEPSS 0.6%CVE-2024-13472HIGHWooCommerce Product Table Lite <= 3.9.4 - Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site ScriptingEPSS 0.6%CVE-2026-39891HIGHPraisonAI has a Template Injection in Agent Tool DefinitionsEPSS 0.6%CVE-2026-28797HIGHRAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" ComponentEPSS 0.6%CVE-2017-20251CRITICALWordPress Insert PHP Plugin 4.7.0 PHP Code Injection via REST APIEPSS 0.6%CVE-2024-55504MEDIUMAn issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially leading to remote coEPSS 0.6%CVE-2024-13495HIGHGamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_ajax_get_logs FunctionEPSS 0.6%CVE-2025-53836CRITICALXWiki Rendering is vulnerable to RCE attacks when processing nested macrosEPSS 0.6%