Falhas do tipo CWE-94

4.448 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2025-55733CRITICALDeepChat One-click Remote Code Execution through Custom URL HandlingEPSS 0.7%CVE-2026-31861HIGHShell Command Injection in Git Routes [CloudCLI UI]EPSS 0.7%CVE-2026-33414MEDIUMPowerShell Command Injection in Podman HyperV MachineEPSS 0.7%CVE-2026-89274CRITICALWP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment ContentEPSS 0.7%CVE-2025-3164MEDIUMTencent Music Entertainment SuperSonic H2 Database Connection testConnect code injectionEPSS 0.7%CVE-2024-27793MEDIUMThe issue was addressed with improved checks. This issue is fixed in iTunes 12.13.2 for Windows. Parsing a file may lead to an unexpected apEPSS 0.7%CVE-2025-26970CRITICALWordPress Ark Theme Core plugin < 1.71.0 - Unauthenticated Remote Code Execution (RCE) vulnerabilityEPSS 0.7%CVE-2026-65941HIGHWhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.EPSS 0.7%CVE-2026-55511CRITICALYamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`EPSS 0.7%CVE-2026-3352HIGHEasy PHP Settings <= 1.0.4 - Authenticated (Administrator+) PHP Code Injection via 'wp_memory_limit' SettingEPSS 0.7%CVE-2024-39017CRITICALagreejs shared v0.0.1 was discovered to contain a prototype pollution via the function mergeInternalComponents. This vulnerability allows atEPSS 0.7%CVE-2024-44430CRITICALSQL Injection vulnerability in Best Free Law Office Management Software-v1.0 allows an attacker to execute arbitrary code and obtain sensitiEPSS 0.7%CVE-2026-4327HIGHThe Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' ParameterEPSS 0.7%CVE-2026-17633HIGHLangflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handlingEPSS 0.7%CVE-2020-7381MEDIUMCode Injection in Rapid7 Nexpose InstallerEPSS 0.7%CVE-2026-17624HIGHLangflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handlingEPSS 0.7%CVE-2024-10572HIGHDenial of Service and Arbitrary File Write in h2oai/h2o-3EPSS 0.7%CVE-2025-0618MEDIUMA malicious third party could invoke a persistent denial of service vulnerability in FireEye EDR agent by sending a specially-crafted tamperEPSS 0.7%CVE-2024-25918CRITICALWordPress InstaWP Connect plugin <= 0.1.0.8 - Remote Code Execution vulnerabilityEPSS 0.7%CVE-2026-44336CRITICALPraisonAI MCP `tools/call` path-traversal and RCE via Python `.pth` injectionEPSS 0.7%