Falhas do tipo CWE-94

4.423 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2026-85978CRITICALUnauthenticated Remote Code Execution in Akana API PlatformEPSS 1.4%CVE-2024-42599HIGHSeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_files.php imposes restrictioEPSS 1.4%CVE-2022-48093HIGHSeacms v12.7 was discovered to contain a remote code execution (RCE) vulnerability via the ip parameter at admin_ ip.php.EPSS 1.4%CVE-2026-6875CRITICALSandbox Escape in ServiceNow AI PlatformEPSS 1.4%CVE-2026-83627CRITICALHummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug LogEPSS 1.4%CVE-2024-33871HIGHAn issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver lEPSS 1.4%CVE-2026-88062CRITICALOmniRoute ACP Custom-Agent Remote Code Execution (RCE)EPSS 1.4%CVE-2023-5201CRITICALOpenHook <= 4.3.0 - Authenticated (Subscriber+) Remote Code Execution via ShortcodeEPSS 1.4%CVE-2024-25502CRITICALDirectory Traversal vulnerability in flusity CMS v.2.4 allows a remote attacker to execute arbitrary code and obtain sensitive information vEPSS 1.4%CVE-2023-30130HIGHAn issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.EPSS 1.4%CVE-2024-23208HIGHThe issue was addressed with improved memory handling. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOEPSS 1.4%CVE-2026-59866CRITICALKiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceNameEPSS 1.4%CVE-2023-47840CRITICALWordPress Qode Essential Addons Plugin <= 1.5.2 is vulnerable to Remote Code Execution (RCE)EPSS 1.4%CVE-2023-21553HIGHAzure DevOps Server Remote Code Execution VulnerabilityEPSS 1.4%CVE-2023-24114CRITICALtypecho 1.1/17.10.30 was discovered to contain a remote code execution (RCE) vulnerability via install.php.EPSS 1.4%CVE-2023-24776—Funadmin v3.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component \controller\Addon.php.EPSS 1.4%CVE-2022-44702HIGHWindows Terminal Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-45200MEDIUMIn Nintendo Mario Kart 8 Deluxe before 3.0.3, the LAN/LDN local multiplayer implementation allows a remote attacker to exploit a stack-basedEPSS 1.4%CVE-2024-22514HIGHAn issue discovered in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to run arbitrary files by restoring a crafted backup file.EPSS 1.4%CVE-2021-22646HIGHOvarro TBox Code InjectionEPSS 1.4%