Falhas do tipo CWE-94

4.402 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2012-0175HIGHThe Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and WindEPSS 26.1%CVE-2025-23121CRITICALA vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain userEPSS 26.0%CVE-2023-34990CRITICALA relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized cEPSS 24.9%CVE-2024-4884CRITICALWhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution VulnerabilityEPSS 24.3%CVE-2025-26264HIGHGeoVision GV-ASWeb with the version 6.1.2.0 or less (fixed in 6.2.0), contains a Remote Code Execution (RCE) vulnerability within its NotifiEPSS 23.0%CVE-2025-5120HIGHSandbox Escape Vulnerability in huggingface/smolagentsEPSS 22.8%CVE-2023-46042—An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo().EPSS 22.6%CVE-2025-23209HIGHPotential RCE with a compromised security key in craft/cmsEPSS 21.8%KEVCVE-2025-55346CRITICALUnintended dynamic code execution leads to remote code execution by network attackersEPSS 20.8%CVE-2022-44088CRITICALESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component INPUT_ISDESCRIPTION.EPSS 20.1%CVE-2021-1585HIGHCisco Adaptive Security Device Manager Remote Code Execution VulnerabilityEPSS 20.0%CVE-2024-42448CRITICALFrom the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform RemEPSS 19.9%CVE-2012-1879HIGHMicrosoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code EPSS 19.6%CVE-2009-2529HIGHMicrosoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not properly handle argument validation for unspecified variables, which allowEPSS 19.5%CVE-2024-20359MEDIUMA vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco AdapEPSS 19.4%KEVCVE-2024-0195MEDIUMspider-flow FunctionController.java FunctionService.saveFunction code injectionEPSS 19.4%CVE-2010-1260HIGHThe IE8 Developer Toolbar in Microsoft Internet Explorer 8 SP1, SP2, and SP3 allows user-assisted remote attackers to execute arbitrary codeEPSS 19.1%CVE-2022-0811—A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cEPSS 19.0%CVE-2025-32583CRITICALWordPress PDF 2 Post Plugin <= 2.4.0 - Remote Code Execution (RCE) vulnerabilityEPSS 19.0%CVE-2020-7012—Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker witEPSS 18.2%