Weaknesses of type CWE-94

4,461 results

Injeção de script

Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.

Example

Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.

How to mitigate

Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.

CVE-2026-13556MEDIUMitsourcecode Online Hotel Management System POST Request controller.php edit cross site scriptingEPSS 0.5%CVE-2026-86216MEDIUMcode-projects Hotel and Tourism Reservation in PHP details.php cross site scriptingEPSS 0.5%CVE-2026-13567MEDIUMcode-projects Online Music Site POST Request Feedback.php cross site scriptingEPSS 0.5%CVE-2026-90527MEDIUMquequnlong shiyi-blog Add Message API index.vue cross site scriptingEPSS 0.5%CVE-2026-90615MEDIUMSourceCodester Class and Exam Timetabling System subject1.php cross site scriptingEPSS 0.5%CVE-2026-7596MEDIUMnextlevelbuilder ui-ux-pro-max-skill Slide Generator generate-slide.py data.get cross site scriptingEPSS 0.5%CVE-2026-75078MEDIUMSourceCodester Class and Exam Timetabling System BSHRM1.php cross site scriptingEPSS 0.5%CVE-2026-82554MEDIUMSourceCodester Queue Management System add_customer.php cross site scriptingEPSS 0.5%CVE-2026-94035MEDIUMSourceCodester Drug Recommendation System index.php cross site scriptingEPSS 0.5%CVE-2026-78059MEDIUMSourceCodester Stock Management System printOrder.php cross site scriptingEPSS 0.5%CVE-2026-13499MEDIUMyashpokharna2555 restaurent-management-system Registration login_register.php cross site scriptingEPSS 0.5%CVE-2026-15596MEDIUMSourceCodester Class and Exam Timetabling System subject.php cross site scriptingEPSS 0.5%CVE-2026-16220MEDIUMcode-projects Online Examination System account.php cross site scriptingEPSS 0.5%CVE-2026-82700MEDIUMcode-projects Online Shopping System Newsletter Subscription offersmail.php cross site scriptingEPSS 0.5%CVE-2026-79793MEDIUMcode-projects Online Shopping System sumit_form.php cross site scriptingEPSS 0.5%CVE-2026-3962MEDIUMJcharis Machine-Learning-Web-Apps Jinja2 Template app.py render_template cross site scriptingEPSS 0.5%CVE-2026-3951MEDIUMLockerProject Locker Error Response registry.js authIsAwesome cross site scriptingEPSS 0.5%CVE-2026-78060MEDIUMSourceCodester Stock Management System getOrderReport.php cross site scriptingEPSS 0.5%CVE-2026-15595MEDIUMSourceCodester Class and Exam Timetabling System forsubject.php cross site scriptingEPSS 0.5%CVE-2026-7116MEDIUMcode-projects Employee Management System mark.php cross site scriptingEPSS 0.5%