Falhas do tipo CWE-94

4.891 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2019-1150HIGHMicrosoft Graphics Remote Code Execution VulnerabilityEPSS 26.2%CVE-2012-0175HIGHThe Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and WindEPSS 26.1%CVE-2023-46042—An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo().EPSS 25.3%CVE-2025-8155MEDIUMD-Link DCS-6010L Management Application vb.htm cross site scriptingEPSS 25.3%CVE-2023-34990CRITICALA relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized cEPSS 25.0%CVE-2025-59536HIGHClaude Code's startup trust dialog could lead to Command Execution attackEPSS 24.9%CVE-2025-23121CRITICALA vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain userEPSS 24.7%CVE-2024-4884CRITICALWhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution VulnerabilityEPSS 24.3%CVE-2026-60004CRITICALGitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.EPSS 24.0%KEVCVE-2025-55346CRITICALUnintended dynamic code execution leads to remote code execution by network attackersEPSS 23.8%CVE-2025-26264HIGHGeoVision GV-ASWeb with the version 6.1.2.0 or less (fixed in 6.2.0), contains a Remote Code Execution (RCE) vulnerability within its NotifiEPSS 23.8%CVE-2025-8356CRITICALPath Traversal leading to RCEEPSS 22.7%CVE-2024-58258HIGHSugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.EPSS 22.4%CVE-2025-23209HIGHPotential RCE with a compromised security key in craft/cmsEPSS 21.6%KEVCVE-2022-44088CRITICALESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component INPUT_ISDESCRIPTION.EPSS 20.5%CVE-2024-42448CRITICALFrom the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform RemEPSS 20.4%CVE-2025-32583CRITICALWordPress PDF 2 Post Plugin <= 2.4.0 - Remote Code Execution (RCE) vulnerabilityEPSS 20.3%CVE-2021-1585HIGHCisco Adaptive Security Device Manager Remote Code Execution VulnerabilityEPSS 20.0%CVE-2012-1879HIGHMicrosoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code EPSS 19.6%CVE-2009-2529HIGHMicrosoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not properly handle argument validation for unspecified variables, which allowEPSS 19.5%