Falhas do tipo CWE-94

4.442 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2023-22731CRITICALImproper Control of Generation of Code in Twig rendered views in shopwareEPSS 1.3%CVE-2026-45140CRITICALChamilo LMS CStudio upload flow allows unauthenticated remote code executionEPSS 1.3%CVE-2022-44533HIGHA vulnerability in the Aruba EdgeConnect Enterprise web management interface allows remote authenticated users to run arbitrary commands on EPSS 1.3%CVE-2024-39331CRITICALIn Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as sEPSS 1.3%CVE-2024-6507HIGHDeep Lake Kaggle command injectionEPSS 1.3%CVE-2026-37003CRITICALAgno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection. The PythonTools and ShellTools components EPSS 1.3%CVE-2022-36069HIGHPoetry Argument Injection vulnerability can lead to local Code ExecutionEPSS 1.3%CVE-2023-24676HIGHAn issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameEPSS 1.3%CVE-2025-27678CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Client Remote Code Execution V-2023EPSS 1.3%CVE-2024-21546CRITICALVersions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetyEPSS 1.3%CVE-2025-25789CRITICALFoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controller\Sitemap.php.EPSS 1.3%CVE-2024-12729HIGHA post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older thaEPSS 1.3%CVE-2024-41714HIGHA vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoice Business Solution Virtual Instance (MEPSS 1.3%CVE-2023-5221MEDIUMForU CMS index.php code injectionEPSS 1.3%CVE-2024-11600HIGHBorderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.6.0 - Authenticated (Administrator+) Remote Code ExecutionEPSS 1.3%CVE-2022-39326HIGHkartverket/github-workflows's run-terraform allows for RCE via terraform planEPSS 1.3%CVE-2021-38243CRITICALxunruicms up to v4.5.1 was discovered to contain a remote code execution (RCE) vulnerability in /index.php. This vulnerability allows attackEPSS 1.3%CVE-2022-2636HIGHCode Injection in hestiacp/hestiacpEPSS 1.3%CVE-2025-3509HIGHPre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege EscalationEPSS 1.3%CVE-2022-45907CRITICALIn PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely.EPSS 1.3%