Falhas do tipo CWE-94

4.891 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2023-29861CRITICALAn issue found in FLIR-DVTEL version not specified allows a remote attacker to execute arbitrary code via a crafted request to the managemenEPSS 1.8%CVE-2024-39864CRITICALApache CloudStack: Integration API service uses dynamic port when disabledEPSS 1.8%CVE-2024-21674HIGHThis High severity Remote Code Execution (RCE) vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server. Remote EPSS 1.8%CVE-2006-7105CRITICALPHP remote file inclusion vulnerability in libs/Smarty.class.php in Smarty 2.6.9 allows remote attackers to execute arbitrary PHP code via aEPSS 1.8%CVE-2026-66147CRITICALAn unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which alloEPSS 1.8%CVE-2024-29937CRITICALNFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitraryEPSS 1.8%CVE-2023-44011CRITICALAn issue in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the layout.master skin file at tEPSS 1.8%CVE-2024-1015CRITICALRemote command execution vulnerability in SE-elektronic GmbH E-DDC3.3EPSS 1.8%CVE-2026-0322HIGHPAN-OS: Authenticated Remote Code Execution (RCE) in the Management InterfaceEPSS 1.7%KEVCVE-2023-34237HIGHRemote code execution via specially crafted script settings in SABnzbdEPSS 1.7%CVE-2023-39059—An issue in ansible semaphore v.2.8.90 allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables paramEPSS 1.7%CVE-2022-36006HIGHAuthenticated remote code execution due to insecure deserialization (GHSL-2022-063)EPSS 1.7%CVE-2021-39160CRITICALCode injection in nbgitpullerEPSS 1.7%CVE-2022-46161CRITICALCode injection in pdfmakeEPSS 1.7%CVE-2024-39877HIGHApache Airflow: DAG Author Code Execution possibility in airflow-schedulerEPSS 1.7%CVE-2021-22961—A code injection vulnerability exists within the firewall software of GlassWire v2.1.167 that could lead to arbitrary code execution from a EPSS 1.7%CVE-2022-25812—Transposh WordPress Translation < 1.0.8 - Admin+ RCEEPSS 1.7%CVE-2021-24430—Speed Booster Pack 4.2.0-beta - Authenticated (admin+) RCEEPSS 1.7%CVE-2025-14287HIGHCommand Injection in mlflow/mlflowEPSS 1.7%CVE-2024-31666CRITICALAn issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via a crafted script to the edit_addon_post.php component.EPSS 1.7%