Weaknesses of type CWE-94
4,455 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-33154HIGHdynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja ResolverEPSS 0.6%CVE-2024-10761MEDIUMUmbraco CMS Dashboard frame cross site scriptingEPSS 0.6%CVE-2025-0806MEDIUMcode-projects Job Recruitment _call_job_search_ajax.php cross site scriptingEPSS 0.6%CVE-2026-77602CRITICALOpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)EPSS 0.6%CVE-2023-43792MEDIUMbaserCMS Code Injection Vulnerability in Mail Form FeatureEPSS 0.6%CVE-2025-7887MEDIUMZavy86 WikiDocs template.inc.php cross site scriptingEPSS 0.6%CVE-2024-26362HIGHHTML injection vulnerability in Enpass Password Manager Desktop Client 6.9.2 for Windows and Linux allows attackers to run arbitrary HTML coEPSS 0.6%CVE-2026-47398HIGHPraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334EPSS 0.6%CVE-2025-4022MEDIUMweb-arena-x webarena evaluators.py HTMLContentEvaluator code injectionEPSS 0.6%CVE-2024-5834MEDIUMInappropriate implementation in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to execute arbitrary code via a craftEPSS 0.6%CVE-2026-61444CRITICALPraisonAI before 4.6.78 Code Injection via f-stringEPSS 0.6%CVE-2024-34225MEDIUMCross Site Scripting vulnerability in php-lms/admin/?page=system_info in Computer Laboratory Management System using PHP and MySQL 1.0 allowEPSS 0.6%CVE-2026-21570HIGHThis High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0EPSS 0.6%CVE-2023-0598HIGHGE Digital Proficy Code InjectionEPSS 0.6%CVE-2024-11660MEDIUMcode-projects Farmacia usuario.php cross site scriptingEPSS 0.6%CVE-2025-66580CRITICALDive has Cross-Site Scripting vulnerability that can escalate to Remote Code ExecutionEPSS 0.6%CVE-2026-33881HIGHWindmill: Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS executorEPSS 0.6%CVE-2025-5177MEDIUMRealce Tecnologia Queue Ticket Kiosk Admin Login Page index.php cross site scriptingEPSS 0.6%CVE-2026-77414CRITICALJSONata: Arbitrary Code Execution via crafted JSONata expressionsEPSS 0.6%CVE-2024-22123LOWZabbix Arbitrary File ReadEPSS 0.6%