Falhas do tipo CWE-94

4.404 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2021-36394—In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.EPSS 7.0%CVE-2026-27174CRITICALMajorDoMo Unauthenticated Remote Code Execution via Admin Console EvalEPSS 7.0%CVE-2024-5466HIGHRemote Code ExecutionEPSS 7.0%CVE-2024-55964CRITICALAn issue was discovered in Appsmith before 1.52. An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote commandEPSS 6.6%CVE-2025-61260CRITICALA vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context ProtoEPSS 6.6%CVE-2022-47879HIGHA Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classesEPSS 6.3%CVE-2017-16544HIGHIn the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of fiEPSS 6.2%CVE-2026-31861HIGHShell Command Injection in Git Routes [CloudCLI UI]EPSS 6.0%CVE-2021-45029—Apache ShenYu 2.4.1 Groovy Code Injection & SpEL InjectionEPSS 6.0%CVE-2020-10055—A vulnerability has been identified in Desigo CC (V4.x), Desigo CC (V3.x), Desigo CC Compact (V4.x), Desigo CC Compact (V3.x). Affected applEPSS 6.0%CVE-2024-29201CRITICALJumpServer's insecure Ansible playbook validation leads to RCE in CeleryEPSS 5.9%CVE-2024-29202CRITICALJumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in CeleryEPSS 5.9%CVE-2016-5402HIGHA code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker wEPSS 5.9%CVE-2026-44262CRITICALScramble: Remote code execution via evaluation of user-controlled input in validation rulesEPSS 5.9%CVE-2026-19478CRITICALImproper Control of Generation of Code ('Code Injection') in GitLabEPSS 5.8%CVE-2024-28116HIGHServer-Side Template Injection (SSTI) with Grav CMS security sandbox bypassEPSS 5.8%CVE-2023-33131HIGHMicrosoft Outlook Remote Code Execution VulnerabilityEPSS 5.7%CVE-2022-24780HIGHCode Injection in Combodo iTopEPSS 5.7%CVE-2026-21877CRITICALn8n is vulnerable to Remote Code Execution via Arbitrary File WriteEPSS 5.4%CVE-2025-24293CRITICAL# Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe imageEPSS 5.4%