Falhas do tipo CWE-94

4.436 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2025-34127CRITICALAchat v0.150 SEH Buffer Overflow via UDPEPSS 1.6%CVE-2023-51784CRITICALApache InLong: Remote Code Execution vulnerability in Apache InLong ManagerEPSS 1.6%CVE-2023-46480CRITICALAn issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter oEPSS 1.6%CVE-2023-29963HIGHS-CMS v5.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /admin/ajax.php.EPSS 1.6%CVE-2024-27972CRITICALWordPress WP Fusion Lite plugin <= 3.41.24 - Remote Code Execution (RCE) vulnerabilityEPSS 1.6%CVE-2024-30565HIGHAn issue was discovered in SeaCMS version 12.9, allows remote attackers to execute arbitrary code via admin notify.php.EPSS 1.6%CVE-2022-44089CRITICALESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component IS_GETCACHE.EPSS 1.6%CVE-2022-44087CRITICALESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component UPFILE_PIC_ZOOM_HIGHT.EPSS 1.6%CVE-2022-24512MEDIUM.NET and Visual Studio Remote Code Execution VulnerabilityEPSS 1.6%CVE-2022-26112CRITICALPinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function supportEPSS 1.6%CVE-2024-47208CRITICALApache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCEEPSS 1.6%CVE-2024-25291CRITICALDeskfiler v1.2.3 allows attackers to execute arbitrary code via uploading a crafted plugin.EPSS 1.6%CVE-2011-10013CRITICALTraq 2.0–2.3 admincp/common.php RCEEPSS 1.6%CVE-2024-43469HIGHAzure CycleCloud Remote Code Execution VulnerabilityEPSS 1.6%CVE-2023-32697HIGHSqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlledEPSS 1.6%CVE-2024-22116CRITICALRemote code execution within ping scriptEPSS 1.6%CVE-2026-73678CRITICALMindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec()EPSS 1.6%CVE-2024-28119HIGHGrav vulnerable to Server Side Template Injection (SSTI) via Twig escape handlerEPSS 1.6%CVE-2023-36718HIGHMicrosoft Virtual Trusted Platform Module Remote Code Execution VulnerabilityEPSS 1.6%CVE-2019-7486—Code injection in SonicWall SMA100 allows an authenticated user to execute arbitrary code in viewcacert CGI script. This vulnerability impacEPSS 1.6%