Falhas do tipo CWE-94

4.442 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2026-23946MEDIUMTendenci has Authenticated Remote Code Execution via Pickle DeserializationEPSS 0.9%CVE-2026-25817HIGHHMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 haEPSS 0.9%CVE-2026-76224HIGHArcadeDB before 26.8.1 Remote Code Execution via Groovy FallbackEPSS 0.9%CVE-2026-86732HIGHCraft CMS before 5.10.12 Remote Code Execution via element-indexEPSS 0.9%CVE-2024-55241HIGHAn issue in deep-diver LLM-As-Chatbot before commit 99c2c03 allows a remote attacker to execute arbitrary code via the modelsbyom.py componeEPSS 0.9%CVE-2024-4662HIGHOxygen Builder <= 4.8.2 - Authenticated (Contributor+) Remote Code ExecutionEPSS 0.9%CVE-2026-50872CRITICALAn issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attackers to execute arbitrary commands and obtaEPSS 0.8%CVE-2026-8855HIGHIBM HTTP Server is affected by multiple vulnerabilitiesEPSS 0.8%CVE-2023-25054CRITICALWordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to Remote Code Execution (RCE)EPSS 0.8%CVE-2026-42090CRITICALNotesnook: RCE via stored XSS in note export renderingEPSS 0.8%CVE-2024-50611HIGHCycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as builEPSS 0.8%CVE-2025-41699HIGHPhoenix Contact: Security Advisory for CHARX SEC-3xxx charging controllersEPSS 0.8%CVE-2024-10035CRITICALCode Injection in BG-TEK's CoslatV3EPSS 0.8%CVE-2025-62429HIGHClipBucket v5 executes arbitrary PHP codeEPSS 0.8%CVE-2026-40342CRITICALFirebird: Path Traversal + Arbitrary File Write Leads to Remote Code ExecutionEPSS 0.8%CVE-2026-41138HIGHFlowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas.EPSS 0.8%CVE-2025-5392CRITICALGB Forms DB <= 1.0.2 - Unauthenticated Remote Code ExecutionEPSS 0.8%CVE-2026-33938HIGHHandlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-blockEPSS 0.8%CVE-2026-9135CRITICALPolicies Component Dynamic CodeInput Fields Bypass Custom Component ValidationEPSS 0.8%CVE-2026-56185MEDIUMWindows Admin Center Information Disclosure VulnerabilityEPSS 0.8%