Falhas do tipo CWE-94

4.447 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2024-56334HIGHCommand injection vulnerability in getWindowsIEEE8021x (SSID) function in systeminformationEPSS 0.7%CVE-2026-13014CRITICALRemote Code Execution vulnerability in "Suspicious" applicationEPSS 0.7%CVE-2024-2610MEDIUMUsing a markup injection an attacker could have stolen nonce values. This could have been used to bypass strict content security policies. TEPSS 0.7%CVE-2024-57099CRITICALClassCMS v4.8 has a code execution vulnerability. Attackers can exploit this vulnerability by constructing a payload in the classview parameEPSS 0.7%CVE-2026-41486HIGHRay: Remote Code Execution via Parquet Arrow Extension Type DeserializationEPSS 0.7%CVE-2026-73166HIGHNozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the web management inteEPSS 0.7%CVE-2025-46059CRITICALlangchain-ai v0.3.51 was discovered to contain an indirect prompt injection vulnerability in the GmailToolkit component. This vulnerability EPSS 0.7%CVE-2025-5333CRITICALUnauthenticated Remote Code Execution in IT Management SuiteEPSS 0.7%CVE-2024-32599CRITICALWordPress WP Dummy Content Generator plugin <= 3.2.1 - Arbitrary Code Execution vulnerabilityEPSS 0.7%CVE-2026-10789CRITICALMCP Extension Code Injection Vulnerability in Autodesk Fusion DesktopEPSS 0.7%CVE-2024-44758CRITICALAn arbitrary file upload vulnerability in the component /Production/UploadFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to EPSS 0.7%CVE-2023-7148MEDIUMShifuML shifu Java Expression Language DataPurifier.java code injectionEPSS 0.7%CVE-2026-31225HIGHThe superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The _parse_op_paEPSS 0.7%CVE-2025-42922CRITICALInsecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service)EPSS 0.7%CVE-2025-3842MEDIUMpanhainan DS-Java FileUpload.java uploadUserPic.action code injectionEPSS 0.7%CVE-2024-32680HIGHWordPress HUSKY plugin <= 1.3.5.2 - Remote Code Execution (RCE) vulnerabilityEPSS 0.7%CVE-2026-2964LOWhiguma web-audio-recorder-js Dynamic Config Handling WebAudioRecorder.js extend prototype pollutionEPSS 0.7%CVE-2026-41249HIGHCoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` ConfigurationEPSS 0.7%CVE-2026-44827HIGHDiffusers: None.py Trust Remote Code BypassEPSS 0.7%CVE-2025-42950CRITICALCode Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)EPSS 0.7%