Falhas do tipo CWE-94

4.891 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2026-19478CRITICALImproper Control of Generation of Code ('Code Injection') in GitLabEPSS 2.2%CVE-2025-34277CRITICALNagios Log Server < 2024R1.3.1 RCE via Malformed Dashboard IDEPSS 2.2%CVE-2020-11057CRITICALCode Injection in XWiki PlatformEPSS 2.2%CVE-2024-43202CRITICALApache DolphinScheduler: Remote Code Execution VulnerabilityEPSS 2.1%CVE-2020-7013—Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB EPSS 2.1%CVE-2023-27650CRITICALAn issue found in APUS Group Launcher v.3.10.73 and v.3.10.88 allows a remote attacker to execute arbitrary code via the FONT_FILE parameterEPSS 2.1%CVE-2024-4181HIGHCommand Injection in run-llama/llama_indexEPSS 2.1%CVE-2020-8274—Citrix Secure Mail for Android before 20.11.0 suffers from Improper Control of Generation of Code ('Code Injection') by allowing unauthenticEPSS 2.1%CVE-2022-46101HIGHAyaCMS v3.1.2 was found to have a code flaw in the ust_sql.inc.php file, which allows attackers to cause command execution by inserting maliEPSS 2.1%CVE-2023-33733HIGHReportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file.EPSS 2.1%CVE-2025-51482HIGHRemote Code Execution in letta.server.rest_api.routers.v1.tools.run_tool_from_source in letta-ai Letta 0.7.12 allows remote attackers to exeEPSS 2.1%CVE-2026-8467CRITICALUnauthenticated remote code execution via HEEx template injection in phoenix_storybook playgroundEPSS 2.1%CVE-2023-43651HIGHRemote code execution on the host system via MongoDB shell in jumpserverEPSS 2.1%CVE-2025-29631CRITICALGardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow commandEPSS 2.1%CVE-2021-32621HIGHScript injection without script or programming rights through Gadget titlesEPSS 2.1%CVE-2022-35777HIGHVisual Studio Remote Code Execution VulnerabilityEPSS 2.1%CVE-2026-8857NONEFull RCE using EasyTimeline ExtensionEPSS 2.1%CVE-2021-21415HIGHVisual Studio Code Prisma Extension Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-45132CRITICALIn Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 temEPSS 2.1%CVE-2022-40486HIGHTP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 57450(5553) was discovered to allow authenticated attackers to execute arbEPSS 2.1%