Falhas do tipo CWE-94

4.497 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2026-24249HIGHNVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful explEPSS 0.2%CVE-2026-0580MEDIUMSourceCodester API Key Manager App Import Key cross site scriptingEPSS 0.2%CVE-2026-55895MEDIUMVim: Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filenameEPSS 0.2%CVE-2026-2201MEDIUMZeroWdd studentmanager LeaveController.java addLeave cross site scriptingEPSS 0.2%CVE-2025-42901MEDIUMCode Injection vulnerability in SAP Application Server for ABAP (BAPI Browser)EPSS 0.2%CVE-2026-40158HIGHPraisonAI has Improper Control of Generation of Code ('Code Injection') and Protection Mechanism Failure in praisonaiEPSS 0.2%CVE-2024-30964HIGHInsecure Permissions vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allowEPSS 0.2%CVE-2025-15249MEDIUMzhujunliang3 work_platform Content cross site scriptingEPSS 0.2%CVE-2026-1151MEDIUMtechnical-laohu mpay User Center cross site scriptingEPSS 0.2%CVE-2025-15248MEDIUMsunhailin12315 product-review 商品评价系统 Write a Review cross site scriptingEPSS 0.2%CVE-2026-63325HIGHRedocly CLI: Arbitrary code execution via Arazzo `$faker` expression using `respect`EPSS 0.2%CVE-2026-55522HIGHPraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe codeEPSS 0.2%CVE-2026-0588MEDIUMXinhu Rainrock RockOA API rockfun.php cross site scriptingEPSS 0.2%CVE-2026-9147HIGHuproot 5.7.4 and prior Code Injection via TStreamerInfo MetadataEPSS 0.2%CVE-2025-14576HIGHPossible QML code injection in VectorImage componentEPSS 0.2%CVE-2026-11491MEDIUMCodeAstro Human Resource Management System Notice Board Management All_notice cross site scriptingEPSS 0.2%CVE-2026-65082HIGHNVIDIA NemoClaw for Linux contains a vulnerability in its migration command, where a local attacker could cause code injection. A successfulEPSS 0.2%CVE-2022-29815MEDIUMIn JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possibleEPSS 0.2%CVE-2022-41576HIGHThe rphone module has a script that can be maliciously modified.Successful exploitation of this vulnerability may cause irreversible programEPSS 0.2%CVE-2026-26682HIGHAn issue in fastCMS before v.0.1.6 allows a local attacker to execute arbitrary code via the PluginController.java componentEPSS 0.2%