Falhas do tipo CWE-94

4.891 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2026-26830CRITICALpdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and conEPSS 2.5%CVE-2026-65008CRITICALGrav before 2.0.7 Remote Code Execution via Blueprint dynamicDataEPSS 2.5%CVE-2013-10035HIGHProcessMaker Open Source < 2.5.2 neoclassic Skin PHP Code ExecutionEPSS 2.5%CVE-2026-4354MEDIUMTRENDnet TEW-824DRU Web apply_sec.cgi sub_420A78 cross site scriptingEPSS 2.5%CVE-2011-10013CRITICALTraq 2.0–2.3 admincp/common.php RCEEPSS 2.5%CVE-2022-34821HIGHA vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2), EPSS 2.5%CVE-2021-43811HIGHCode injection via unsafe YAML loadingEPSS 2.5%CVE-2024-57487MEDIUMIn Code-Projects Online Car Rental System 1.0, the file upload feature does not validate file extensions or MIME types allowing an attacker EPSS 2.5%CVE-2024-54805CRITICALNetgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updaEPSS 2.5%CVE-2024-54807CRITICALIn Netgear WNR854T 1.5.2 (North America), the UPNP service is vulnerable to command injection in the function addmap_exec which parses the NEPSS 2.5%CVE-2017-16020—Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary EPSS 2.5%CVE-2026-24107CRITICALAn issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate the value of `usbPartitionName`, which is directly used in `doSEPSS 2.5%CVE-2024-50960HIGHA command injection vulnerability in the Nmap diagnostic tool in the admin web console of Extron SMP 111 <=3.01, SMP 351 <=2.16, SMP 352 <= EPSS 2.4%CVE-2018-19011—CX-Supervisor (Versions 3.42 and prior) can execute code that has been injected into a project file. An attacker could exploit this to execuEPSS 2.4%CVE-2026-26833CRITICALthumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user iEPSS 2.4%CVE-2022-1575CRITICALArbitrary Code Execution through Sanitizer Bypass in jgraph/drawioEPSS 2.4%CVE-2024-22899HIGHVinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime funcEPSS 2.4%CVE-2022-31860CRITICALAn issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code via a crafted Groovy rule.EPSS 2.4%CVE-2016-15044CRITICALKaltura < 11.1.0-2 PHP Object Injection RCEEPSS 2.4%CVE-2024-28847HIGHSpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadataEPSS 2.4%