Falhas do tipo CWE-94

4.442 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2024-6983HIGHRemote Code Execution in mudler/localaiEPSS 1.3%CVE-2026-22709CRITICALvm2 has a Sandbox EscapeEPSS 1.3%CVE-2026-42537CRITICALApache Ranger: Remote Code Execution via JDBC URL InjectionEPSS 1.3%CVE-2026-47117CRITICALOpenMed < 1.5.2 Remote Code Execution via PII Model LoadingEPSS 1.3%CVE-2024-23746CRITICALMiro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (bEPSS 1.3%CVE-2024-55022HIGHWeintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain an authenticated command injection vulnerability via the HMI NamEPSS 1.3%CVE-2023-37427HIGHAuthenticated Remote Code Execution in EdgeConnect SD-WAN Orchestrator Web-Based Management InterfaceEPSS 1.3%CVE-2007-5565CRITICALPHP remote file inclusion vulnerability in includes/functions.php in phpSCMS 0.0.1-Alpha1 allows remote attackers to execute arbitrary PHP cEPSS 1.3%CVE-2026-14900CRITICALCost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' ParameterEPSS 1.3%CVE-2026-7026MEDIUMD-Link DGS-3420 System Information Settings cross site scriptingEPSS 1.3%CVE-2025-31722HIGHIn Jenkins Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders are not subject to sandbox protection, allowing attackerEPSS 1.3%CVE-2023-46947HIGHSubrion 4.2.1 has a remote command execution vulnerability in the backend.EPSS 1.3%CVE-2026-24780HIGHAutoGPT is Vulnerable to RCE via Disabled Block ExecutionEPSS 1.3%CVE-2012-10032HIGHMaxthon3 about:history XCS Trusted Zone Code ExecutionEPSS 1.3%CVE-2023-22889CRITICALSmartBear Zephyr Enterprise through 7.15.0 mishandles user-defined input during report generation. This could lead to remote code execution EPSS 1.3%CVE-2025-34128HIGHX360 VideoPlayer ActiveX Control Buffer Overflow via ConvertFile()EPSS 1.3%CVE-2026-70553CRITICALMaxSite CMS Unauthenticated RCE via Install EndpointEPSS 1.3%CVE-2023-33472HIGHAn issue was discovered in Scada-LTS v2.7.5.2 build 4551883606 and before, allows remote attackers with low-level authentication to escalateEPSS 1.3%CVE-2024-21649HIGHRemote code execution EPSS 1.3%CVE-2026-34965HIGHCockpit CMS Authenticated Remote Code Execution via CollectionsEPSS 1.3%