Weaknesses of type CWE-94
4,461 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2025-67034HIGHLantronix EDS5000, G520, and X300 OS Command InjectionEPSS 0.5%CVE-2025-59251HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-65854CRITICALInsecure permissions in the scheduled tasks feature of MineAdmin v3.x allows attackers to execute arbitrary commands and execute a full accoEPSS 0.5%CVE-2026-36458CRITICALChestnutCMS v1.5.10 has a SQL injection vulnerability. The content parameter of the cms_content tag can be manipulated in the admin backend EPSS 0.5%CVE-2026-48962HIGHIO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output globEPSS 0.5%CVE-2024-8254MEDIUMEmail Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode ExecutionEPSS 0.5%CVE-2024-12893MEDIUMPortabilis i-Educar Tipo de Usuário Page 2 cross site scriptingEPSS 0.5%CVE-2024-23278HIGHThe issue was addressed with improved checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14EPSS 0.5%CVE-2025-2061MEDIUMcode-projects Online Ticket Reservation System passenger.php cross site scriptingEPSS 0.5%CVE-2025-0134MEDIUMCortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VMEPSS 0.5%CVE-2024-12421MEDIUMCoupon Affiliates – Affiliate Plugin for WooCommerce <= 5.16.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site ScriptingEPSS 0.5%CVE-2023-5512MEDIUMImproper Control of Generation of Code ('Code Injection') in GitLabEPSS 0.5%CVE-2025-2210MEDIUMaitangbao springboot-manager add cross site scriptingEPSS 0.5%CVE-2026-33310HIGHIntake has a Command Injection via shell() Expansion in Parameter DefaultsEPSS 0.5%CVE-2025-2209MEDIUMaitangbao springboot-manager add cross site scriptingEPSS 0.5%CVE-2025-2803HIGHSo-Called Air Quotes <= 0.1 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.5%CVE-2025-2211MEDIUMaitangbao springboot-manager add cross site scriptingEPSS 0.5%CVE-2026-45261CRITICALGitButler: Link injection via forge integration enables arbitrary script executionEPSS 0.5%CVE-2025-8370MEDIUMPortabilis i-Educar educar_escolaridade_lst.php cross site scriptingEPSS 0.5%CVE-2023-39956MEDIUMElectron: Out-of-package code execution when launched with arbitrary cwdEPSS 0.5%