Falhas do tipo CWE-94

3.970 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2015-1635CRITICALHTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote aEPSS 100.0%KEVCVE-2017-9841CRITICALUtil/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST daEPSS 100.0%KEVCVE-2022-22954CRITICALVMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A maliEPSS 100.0%KEVCVE-2021-22204MEDIUMImproper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing tEPSS 100.0%KEVCVE-2012-0158HIGHThe (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft OfficeEPSS 100.0%KEVCVE-2022-22963CRITICALIn Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user toEPSS 99.9%KEVCVE-2025-49704HIGHMicrosoft SharePoint Remote Code Execution VulnerabilityEPSS 99.9%KEVCVE-2025-32432CRITICALCraft CMS Allows Remote Code ExecutionEPSS 99.8%KEVCVE-2026-33017CRITICALLangflow has Unauthenticated Remote Code Execution via Public Flow Build EndpointEPSS 99.8%KEVCVE-2021-22205CRITICALAn issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that EPSS 99.7%KEVCVE-2019-16759CRITICALvBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring reEPSS 99.7%KEVCVE-2023-3519CRITICALUnauthenticated remote code executionEPSS 99.7%KEVCVE-2022-22965CRITICALA Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specificEPSS 99.7%KEVCVE-2017-7494CRITICALSamba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious cliEPSS 99.4%KEVCVE-2014-6287CRITICALThe findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackeEPSS 99.3%KEVCVE-2018-7602CRITICALDrupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004EPSS 99.2%KEVCVE-2021-44529CRITICALA code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code witEPSS 99.1%KEVCVE-2022-3236CRITICALA code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1EPSS 98.9%KEVCVE-2022-24816CRITICALImproper Control of Generation of Code in jai-extEPSS 98.7%KEVCVE-2022-22947CRITICALIn spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway ActuatEPSS 98.3%KEV