Falhas do tipo CWE-94

4.423 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2022-47318HIGHruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a reposEPSS 1.4%CVE-2006-5610CRITICALPHP remote file inclusion vulnerability in player/includes/common.php in Teake Nutma Foing, as modified in Fully Modded phpBB (phpbbfm) 2021EPSS 1.4%CVE-2026-66786CRITICALSubmariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnetsEPSS 1.4%CVE-2022-48116HIGHAyaCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/tpl_edit.inc.php.EPSS 1.4%CVE-2026-58449CRITICALtxtai - Unauthenticated Remote Code Execution via Unsafe Reflection in API /reindex function ParameterEPSS 1.4%CVE-2025-71389CRITICALCal.com before 5.9.9 Remote Code Execution via RSCEPSS 1.4%CVE-2022-3869MEDIUM Code Injection in froxlor/froxlorEPSS 1.4%CVE-2026-27744CRITICALSPIP tickets < 4.3.3 Unauthenticated RCEEPSS 1.4%CVE-2022-46648HIGHruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a reposEPSS 1.4%CVE-2023-36014HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 1.4%CVE-2024-33445CRITICALAn issue in hisiphp v2.0.111 allows a remote attacker to execute arbitrary code via a crafted script to the SystemPlugins::mkInfo parameter EPSS 1.3%CVE-2023-37470CRITICALMetabase vulnerable to remote code execution via POST /api/setup/validate API endpoint EPSS 1.3%CVE-2024-24780CRITICALApache IoTDB: Remote Code Execution with untrusted URI of User-defined functionEPSS 1.3%CVE-2022-45908CRITICALIn PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on a user-supplied winsEPSS 1.3%CVE-2026-27498CRITICALn8n has Arbitrary Command Execution via File Write and Git OperationsEPSS 1.3%CVE-2020-15171MEDIUMUsers with SCRIPT rights can execute arbitrary code in XWikiEPSS 1.3%CVE-2023-42374CRITICALAn issue in mystenlabs Sui Blockchain before v.1.6.3 allow a remote attacker to execute arbitrary code and cause a denial of service via a cEPSS 1.3%CVE-2025-25675CRITICALTenda AC10 V1.0 V15.03.06.23 has a command injection vulnerablility located in the formexeCommand function. The str variable receives the cmEPSS 1.3%CVE-2023-35034—Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow reEPSS 1.3%CVE-2023-22731CRITICALImproper Control of Generation of Code in Twig rendered views in shopwareEPSS 1.3%