Falhas do tipo CWE-94

4.891 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2026-44262CRITICALScramble: Remote code execution via evaluation of user-controlled input in validation rulesEPSS 5.9%CVE-2024-28116HIGHServer-Side Template Injection (SSTI) with Grav CMS security sandbox bypassEPSS 5.8%CVE-2023-33131HIGHMicrosoft Outlook Remote Code Execution VulnerabilityEPSS 5.7%CVE-2022-24780HIGHCode Injection in Combodo iTopEPSS 5.7%CVE-2025-71243CRITICALSPIP Saisies Plugin < 5.11.1 Remote Code ExecutionEPSS 5.6%CVE-2025-24293CRITICAL# Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe imageEPSS 5.6%CVE-2026-21877CRITICALn8n is vulnerable to Remote Code Execution via Arbitrary File WriteEPSS 5.4%CVE-2026-61450HIGHGrav before 2.0.2 Config Exfiltration via offsetGet FilterEPSS 5.4%CVE-2020-5739—Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpeEPSS 5.3%CVE-2024-21646CRITICALAzure IoT Platform Device SDK Remote Code Execution VulnerabilityEPSS 5.1%CVE-2017-16100—dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible.EPSS 5.1%CVE-2025-3994MEDIUMTOTOLINK N150RT IP Port Filtering home.htm cross site scriptingEPSS 5.0%CVE-2014-5401—Hospira MedNet Code InjectionEPSS 5.0%CVE-2019-6823—A CWE-94: Code Injection vulnerability exists in ProClima (all versions prior to version 8.0.0) which could allow an unauthenticated, remoteEPSS 5.0%CVE-2026-50741HIGHBypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed eithEPSS 4.9%CVE-2022-29221HIGHPHP Code Injection by malicious block or filename in SmartyEPSS 4.9%CVE-2021-42694HIGHAn issue was discovered in the character definitions of the Unicode Specification through 14.0. The specification allows an adversary to proEPSS 4.9%CVE-2021-31198HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 4.9%CVE-2024-28397MEDIUMAn issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.EPSS 4.8%CVE-2026-40466HIGHApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URIEPSS 4.8%