Falhas do tipo CWE-94

4.497 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2026-40156HIGHPraisonAI Affected by Implicit Execution of Arbitrary Code via Automatic `tools.py` LoadingEPSS 0.2%CVE-2022-29814MEDIUMIn JetBrains IntelliJ IDEA before 2022.1 local code execution via HTML descriptions in custom JSON schemas was possibleEPSS 0.2%CVE-2022-29819MEDIUMIn JetBrains IntelliJ IDEA before 2022.1 local code execution via links in Quick Documentation was possibleEPSS 0.2%CVE-2025-11153HIGHJIT miscompilation in the JavaScript Engine: JIT componentEPSS 0.2%CVE-2026-91719MEDIUMCode injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.EPSS 0.2%CVE-2025-23295HIGHNVIDIA Apex for all platforms contains a vulnerability in a Python component where an attacker could cause a code injection issue by providiEPSS 0.2%CVE-2025-33233HIGHNVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability where an attacker could cause code injection. A successful exploitEPSS 0.2%CVE-2025-15134MEDIUMyourmaileyes MOOC Submission MainController.java subreview cross site scriptingEPSS 0.2%CVE-2025-30055CRITICALConditional RCE via the "system" functionEPSS 0.2%CVE-2025-30056CRITICALCalling system commands via RunCommandEPSS 0.2%CVE-2025-14228MEDIUMYealink SIP-T21P E2 Local Directory cross site scriptingEPSS 0.2%CVE-2025-58673MEDIUMWordPress WP User Frontend Plugin <= 4.1.12 - Content Injection VulnerabilityEPSS 0.2%CVE-2023-34195—An issue was discovered in SystemFirmwareManagementRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The implementation of the GetEPSS 0.2%CVE-2026-40287HIGHPraisonAI has RCE via Automatic tools.py ImportEPSS 0.2%CVE-2025-4261MEDIUMGAIR-NLP factool tool.py run_single code injectionEPSS 0.2%CVE-2026-44334HIGHPraisonAI: Unauthenticated RCE via `tool_override.py`EPSS 0.2%CVE-2025-14200MEDIUMalokjaiswal Hotel-Management-services-using-MYSQL-and-php Request Pending usersub.php cross site scriptingEPSS 0.2%CVE-2025-53927MEDIUMMaxKB sandbox bypassEPSS 0.2%CVE-2025-25943HIGHBuffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the AP4_Stz2Atom::AP4_Stz2Atom comEPSS 0.2%CVE-2025-60068MEDIUMWordPress Javo Core plugin <= 3.0.0.266 - Arbitrary Code Execution vulnerabilityEPSS 0.2%