Falhas do tipo CWE-94

4.402 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2026-27966CRITICALLangflow has Remote Code Execution in CSV AgentEPSS 33.7%CVE-2022-40871CRITICALDolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarrEPSS 33.4%CVE-2024-29276CRITICALAn issue was discovered in seeyonOA version 8, allows remote attackers to execute arbitrary code via the importProcess method in WorkFlowDesEPSS 32.8%CVE-2020-8218HIGHA code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code eEPSS 32.7%KEVCVE-2013-3129HIGHMicrosoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, and 4.5; Silverlight 5 before 5.1.20513.0; win32k.sys in the kernel-mode drivers, and GDI+,EPSS 32.4%CVE-2023-0048HIGH Code Injection in lirantal/daloradiusEPSS 32.3%CVE-2009-2512CRITICALThe Web Services on Devices API (WSDAPI) in Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 does not properly process the headEPSS 31.2%CVE-2021-29440HIGHTwig allowing dangerous PHP functions by defaultEPSS 30.6%CVE-2023-6016CRITICALH2O Remote Code Execution via POJO Model ImportEPSS 30.6%CVE-2024-21351HIGHWindows SmartScreen Security Feature Bypass VulnerabilityEPSS 30.3%KEVCVE-2021-31181HIGHMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 30.0%CVE-2024-55661HIGHLaravel Pulse Allows Remote Code Execution via Unprotected Query MethodEPSS 29.5%CVE-2019-1150HIGHMicrosoft Graphics Remote Code Execution VulnerabilityEPSS 28.9%CVE-2022-31161CRITICALRoxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert UploadEPSS 28.4%CVE-2012-0014HIGHMicrosoft .NET Framework 2.0 SP2, 3.5.1, and 4, and Silverlight 4 before 4.1.10111, does not properly restrict access to memory associated wEPSS 28.2%CVE-2010-0492HIGHUse-after-free vulnerability in mstime.dll in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via vectors reEPSS 27.5%CVE-2023-36177CRITICALAn issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information EPSS 27.5%CVE-2024-25415HIGHA remote code execution (RCE) vulnerability in /admin/define_language.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP EPSS 27.2%CVE-2007-5775CRITICALUnspecified vulnerability in BitDefender allows attackers to execute arbitrary code via unspecified vectors, aka EEYEB-20071024. NOTE: as oEPSS 26.9%CVE-2025-59536HIGHClaude Code's startup trust dialog could lead to Command Execution attackEPSS 26.4%