Falhas do tipo CWE-94

4.421 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2026-8467CRITICALUnauthenticated remote code execution via HEEx template injection in phoenix_storybook playgroundEPSS 2.1%CVE-2021-32621HIGHScript injection without script or programming rights through Gadget titlesEPSS 2.1%CVE-2026-8857NONEFull RCE using EasyTimeline ExtensionEPSS 2.1%CVE-2021-21415HIGHVisual Studio Code Prisma Extension Remote Code Execution VulnerabilityEPSS 2.1%CVE-2025-29631CRITICALGardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow commandEPSS 2.1%CVE-2023-22506HIGHThis High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of BambooEPSS 2.1%CVE-2024-48840CRITICALUnauthorized AccessEPSS 2.1%CVE-2024-39962CRITICALD-Link DIR-823X AX3000 Dual-Band Gigabit Wireless Router v21_D240126 was discovered to contain a remote code execution (RCE) vulnerability iEPSS 2.1%CVE-2025-69902CRITICALA command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary comEPSS 2.1%CVE-2016-15044CRITICALKaltura < 11.1.0-2 PHP Object Injection RCEEPSS 2.1%CVE-2026-59861HIGHKiota: Code Generation Literal Injection in Kiota Ruby GeneratorEPSS 2.0%CVE-2022-24663CRITICALRemote Code Execution by Subscriber+ users via WordPress shortcodeEPSS 2.0%CVE-2020-8132—Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructEPSS 2.0%CVE-2020-8274—Citrix Secure Mail for Android before 20.11.0 suffers from Improper Control of Generation of Code ('Code Injection') by allowing unauthenticEPSS 2.0%CVE-2021-32836HIGHPre-auth unsafe deserialization in ZStackEPSS 2.0%CVE-2026-5562MEDIUMprovectus kafka-ui Endpoint testexecutions validateAccess code injectionEPSS 2.0%CVE-2020-5259HIGHPrototype Pollution in DojoxEPSS 2.0%CVE-2024-22188HIGHTYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the priEPSS 2.0%CVE-2026-65008CRITICALGrav before 2.0.7 Remote Code Execution via Blueprint dynamicDataEPSS 2.0%CVE-2022-45132CRITICALIn Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 temEPSS 2.0%