Falhas do tipo CWE-94

4.404 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2026-27577CRITICALn8n: Expression Sandbox Escape Leads to RCEEPSS 10.0%CVE-2026-26026CRITICALGLPI has a Server-Side Template Injection via Double-CompilationEPSS 9.6%CVE-2025-57772HIGHDataease H2 JDBC RCE BypassEPSS 9.3%CVE-2026-58138CRITICALOrkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script EvaluatorsEPSS 9.3%CVE-2024-21534CRITICALAll versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can EPSS 9.0%CVE-2026-1560HIGHCustom Block Builder – Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code ExecutionEPSS 8.9%CVE-2022-35649—The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter EPSS 8.7%CVE-2026-41179CRITICALRClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command executionEPSS 8.6%CVE-2025-57773HIGHDataease DB2 Aspectweaver Deserialization Arbitrary File Write VulnerabilityEPSS 8.3%CVE-2025-58176HIGHDive's improper processing of custom urls can lead to Remote Code ExecutionEPSS 8.2%CVE-2022-36963HIGHSolarWinds Platform Deserialization of Untrusted Data VulnerabilityEPSS 8.2%CVE-2025-1392MEDIUMD-Link DIR-816 index.html cross site scriptingEPSS 8.0%CVE-2024-28848HIGHSpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadataEPSS 7.9%CVE-2024-0252HIGHRemote code executionEPSS 7.8%CVE-2026-0768CRITICALLangflow code Code Injection Remote Code Execution VulnerabilityEPSS 7.8%CVE-2019-14867HIGHA flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way thEPSS 7.4%CVE-2025-23061CRITICALMongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue existEPSS 7.3%CVE-2026-3584CRITICALKali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_processEPSS 7.2%CVE-2024-25110CRITICALAzure IoT Platform Device SDK Remote Code Execution VulnerabilityEPSS 7.2%CVE-2026-23523CRITICALDive allows One-click Remote Code Execution through Deep Links for MCP InstallEPSS 7.2%