Falhas do tipo CWE-94

4.444 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2026-43997CRITICALvm2: Sandbox EscapeEPSS 0.8%CVE-2025-49013CRITICALWilderForge vulnerable to code Injection via GitHub Actions WorkflowsEPSS 0.8%CVE-2024-52899HIGHIBM Data Virtualization Manager code executionEPSS 0.8%CVE-2024-57707CRITICALAn issue in DataEase v1 allows an attacker to execute arbitrary code via the user account and password components.EPSS 0.8%CVE-2026-44006CRITICALvm2: Sandbox EscapeEPSS 0.8%CVE-2024-39669CRITICALIn the Console in Soffid IAM before 3.5.39, necessary checks were not applied to some Java objects. A malicious agent could possibly executeEPSS 0.8%CVE-2025-29401CRITICALAn arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execute arbitrary code viaEPSS 0.8%CVE-2024-51367CRITICALAn arbitrary file upload vulnerability in the component \Users\username.BlackBoard of BlackBoard v2.0.0.2 allows attackers to execute arbitrEPSS 0.8%CVE-2026-36340HIGHAn issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email functionEPSS 0.8%CVE-2024-35315MEDIUMA vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.2EPSS 0.8%CVE-2026-22686CRITICALSandbox Escape via Host Error Prototype Chain in enclave-vmEPSS 0.8%CVE-2026-4681CRITICALCritical Remote Code Execution vulnerability reported in WindchillEPSS 0.8%CVE-2025-10097MEDIUMSimStudioAI sim route.ts code injectionEPSS 0.8%CVE-2026-54237CRITICALWavelog: Unauthenticated Remote Code ExecutionEPSS 0.8%CVE-2024-11697HIGHWhen handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialogEPSS 0.8%CVE-2024-40495HIGHA vulnerability was discovered in Linksys Router E2500 with firmware 2.0.00, allows authenticated attackers to execute arbitrary code via thEPSS 0.8%CVE-2026-39881MEDIUMVim Ex command injection in Vims NetBeans integrationEPSS 0.8%CVE-2024-37821HIGHAn arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitraEPSS 0.8%CVE-2025-26260HIGHPlenti <= 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as jEPSS 0.8%CVE-2025-54063HIGHCherry Studio One-click Remote Code Execution Vulnerability through Custom URL HandlingEPSS 0.8%