Falhas do tipo CWE-94

4.891 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2022-41158HIGHeyoom builder Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-25967HIGHVersions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variableEPSS 2.1%CVE-2023-22506HIGHThis High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of BambooEPSS 2.1%CVE-2022-24663CRITICALRemote Code Execution by Subscriber+ users via WordPress shortcodeEPSS 2.1%CVE-2024-48840CRITICALUnauthorized AccessEPSS 2.1%CVE-2024-39962CRITICALD-Link DIR-823X AX3000 Dual-Band Gigabit Wireless Router v21_D240126 was discovered to contain a remote code execution (RCE) vulnerability iEPSS 2.1%CVE-2026-59861HIGHKiota: Code Generation Literal Injection in Kiota Ruby GeneratorEPSS 2.0%CVE-2020-8132—Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructEPSS 2.0%CVE-2025-70328HIGHTOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost handler of the /usr/sbin/shttpEPSS 2.0%CVE-2021-32836HIGHPre-auth unsafe deserialization in ZStackEPSS 2.0%CVE-2022-3394HIGHWP All Export Pro < 1.7.9 - Authenticated Code InjectionEPSS 2.0%CVE-2020-5259HIGHPrototype Pollution in DojoxEPSS 2.0%CVE-2024-22188HIGHTYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the priEPSS 2.0%CVE-2020-8149—Lack of output sanitization allowed an attack to execute arbitrary shell commands via the logkitty npm package before version 0.7.1.EPSS 2.0%CVE-2022-34714HIGHWindows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityEPSS 2.0%CVE-2025-3472MEDIUMOcean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 2.0%CVE-2026-18937CRITICALBroken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable InjectionEPSS 2.0%CVE-2024-27622HIGHA remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. This vEPSS 2.0%CVE-2026-24105CRITICALAn issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi. The value of `v1` was not checked, potentially leadEPSS 2.0%CVE-2024-56278CRITICALWordPress WP Ultimate Exporter plugin <= 2.9.1 - Remote Code Execution (RCE) vulnerabilityEPSS 2.0%