Falhas do tipo CWE-94

4.497 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2026-26682HIGHAn issue in fastCMS before v.0.1.6 allows a local attacker to execute arbitrary code via the PluginController.java componentEPSS 0.2%CVE-2024-43770HIGHIn gatts_process_find_info of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (EPSS 0.2%CVE-2026-86320HIGHFlatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)EPSS 0.2%CVE-2025-14205MEDIUMcode-projects Chamber of Commerce Membership Management System Your Info membership_profile.php cross site scriptingEPSS 0.2%CVE-2026-43961HIGHVim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code executionEPSS 0.2%CVE-2022-29813MEDIUMIn JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possibleEPSS 0.2%CVE-2025-70341HIGHInsecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files.EPSS 0.2%CVE-2026-33941HIGHHandlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and OptionsEPSS 0.2%CVE-2026-71614HIGHAn issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/media_tools/dvb_mpe.c, deEPSS 0.2%CVE-2025-7711MEDIUMClassified Listing – Classified ads & Business Directory Plugin <= 5.0.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Listing DescriptionEPSS 0.2%CVE-2024-56448MEDIUMVulnerability of improper access control in the home screen widget module Impact: Successful exploitation of this vulnerability may affect aEPSS 0.2%CVE-2025-26238HIGHIn D-Link DI-8100G 17.12.20A1, the flag parameter in msp_info can be exploited to execute arbitrary code.EPSS 0.2%CVE-2026-44244HIGHGitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPathEPSS 0.2%CVE-2026-11231HIGHInappropriate implementation in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary EPSS 0.2%CVE-2023-36923HIGHCode Injection vulnerability in SAP PowerDesignerEPSS 0.2%CVE-2026-41692MEDIUMi18nextify is vulnerable to DOM XSS via javascript:/data: URL schemes in translated href/src attributesEPSS 0.2%CVE-2026-2222MEDIUMcode-projects Online Reviewer System btn_functions.php cross site scriptingEPSS 0.2%CVE-2024-3892HIGHLocal code execution vulnerability in Telerik UI for WinFormsEPSS 0.2%CVE-2024-33225HIGHAn issue in the component RTKVHD64.sys of Realtek Semiconductor Corp Realtek(r) High Definition Audio Function Driver v6.0.9549.1 allows attEPSS 0.2%CVE-2025-13577MEDIUMPHPGurukul Hostel Management System register-complaint.php cross site scriptingEPSS 0.2%