Falhas do tipo CWE-94

4.448 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2025-3115CRITICALSpotfire Data Function VulnerabilityEPSS 0.7%CVE-2026-14602CRITICALRemote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query ParameterEPSS 0.7%CVE-2026-41507CRITICALRemote Code Execution (RCE) via String Literal Injection into math-codegenEPSS 0.7%CVE-2026-14289CRITICALWP FacturaONE < 5.37 - Unauthenticated Remote Code ExecutionEPSS 0.7%CVE-2026-15497MEDIUMSonicCloudOrg sonic-agent JWT Authentication Filter ExchangeController.java code injectionEPSS 0.7%CVE-2025-25467CRITICALInsufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating aEPSS 0.7%CVE-2026-73701CRITICALUnauthenticated Remote Code Execution in HPE Networking Fabric ComposerEPSS 0.7%CVE-2026-25587CRITICALSandboxJS has a Sandbox EscapeEPSS 0.7%CVE-2026-49143HIGHBrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP HandlerEPSS 0.7%CVE-2026-90999CRITICALSentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environmentEPSS 0.7%CVE-2026-56747HIGHCode Injection in JSON Pointer Processing Component in Cribl StreamEPSS 0.7%CVE-2019-14827—A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contextsEPSS 0.7%CVE-2026-4998MEDIUMSinaptik AI PandasAI Chat Message code_executor.py CodeExecutor.execute code injectionEPSS 0.7%CVE-2025-5150MEDIUMdocarray Web API torch_dataset.py __getitem__ prototype pollutionEPSS 0.7%CVE-2024-6940MEDIUMDedeCMS article_template_rand.php code injectionEPSS 0.7%CVE-2026-88856CRITICALJoomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7EPSS 0.7%CVE-2026-85192CRITICALJoomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.0EPSS 0.7%CVE-2025-5013MEDIUMHkCms Search index.html cross site scriptingEPSS 0.7%CVE-2026-78834HIGHA code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin. An authenticated low-privileged user who can modify page conEPSS 0.7%CVE-2026-93985CRITICALOpenPanel js-runtime JavaScript Template Sandbox Escape RCEEPSS 0.7%