Falhas do tipo CWE-94

4.443 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2026-30457CRITICALAn issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.EPSS 0.8%CVE-2026-30643CRITICALAn issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload.EPSS 0.8%CVE-2025-1613MEDIUMFiberHome AN5506-01A ONU GPON URL Filtering Submenu URL_filterCfg cross site scriptingEPSS 0.8%CVE-2025-1614MEDIUMFiberHome AN5506-01A ONU GPON Port Forwarding Submenu portForwardingCfg cross site scriptingEPSS 0.8%CVE-2026-55585HIGHQWED: Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`EPSS 0.8%CVE-2026-42396MEDIUMInsufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to FailEPSS 0.8%CVE-2026-51974HIGHAn eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remoEPSS 0.8%CVE-2026-2052HIGHWidget Options <= 4.2.2 - Authenticated (Contributor+) Remote Code Execution via Display LogicEPSS 0.8%CVE-2026-65880CRITICALJoomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3EPSS 0.8%CVE-2023-33229LOWSolarWinds Platform Incorrect Input Neutralization VulnerabilityEPSS 0.8%CVE-2024-51757CRITICALFixes security vulnerability that allowed for server side code to be executed by a <script> tagEPSS 0.8%CVE-2024-37845HIGHMangoOS before 5.2.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the Active Process Command feaEPSS 0.8%CVE-2026-4965MEDIUMletta-ai letta Incomplete Fix CVE-2025-6101 ast_parsers.py resolve_type eval injectionEPSS 0.8%CVE-2026-86793CRITICALCVE-2026-86793EPSS 0.8%CVE-2020-36875CRITICALAccessAlly < 3.3.2 Unauthenticated Arbitrary PHP Code ExecutionEPSS 0.8%CVE-2026-73487CRITICALFlowise before 3.1.3 Prompt Injection RCE via CSV AgentEPSS 0.8%CVE-2024-39071CRITICALFujian Kelixun <=7.6.6.4391 is vulnerable to SQL Injection in send_event.php.EPSS 0.8%CVE-2023-1482MEDIUMHkCms External Plugin code injectionEPSS 0.8%CVE-2026-44758CRITICALCode Injection vulnerability in Manufacturing Integration and IntelligenceEPSS 0.8%CVE-2026-41512CRITICALRemote code execution via JavaScript injection in `BrowserAutomation::PlaywrightService`EPSS 0.8%