Weaknesses of type CWE-94
4,461 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-75077MEDIUMSourceCodester Class and Exam Timetabling System BSCE2.php cross site scriptingEPSS 0.5%CVE-2026-13554MEDIUMitsourcecode Online Hotel Management System POST Request controller.php add cross site scriptingEPSS 0.5%CVE-2026-78055MEDIUMSourceCodester Class and Exam Timetabling System BSIT2.php cross site scriptingEPSS 0.5%CVE-2026-86244MEDIUMFastAdmin User Controller User.php login cross site scriptingEPSS 0.5%CVE-2026-16486MEDIUMSourceCodester Class and Exam Timetabling System BSIS.php cross site scriptingEPSS 0.5%CVE-2026-91854MEDIUMcode-projects Record Management System reg.php cross site scriptingEPSS 0.5%CVE-2026-86294MEDIUMSourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scriptingEPSS 0.5%CVE-2026-86668MEDIUMaircheng-org iWebShop-5 pic.php uploadFile cross site scriptingEPSS 0.5%CVE-2026-86278MEDIUMSourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scriptingEPSS 0.5%CVE-2026-90795MEDIUMitsourcecode Loan Management System navbar.php cross site scriptingEPSS 0.5%CVE-2026-19998MEDIUMcode-projects Online Shopping System offersmail.php cross site scriptingEPSS 0.5%CVE-2026-95396MEDIUMsfturing hosp_order Public Search Handlers HospitalController.java cross site scriptingEPSS 0.5%CVE-2026-90571MEDIUMExrick xmall Order Printing order-print.jsp cross site scriptingEPSS 0.5%CVE-2026-87926MEDIUMRizwan17 inventory-management-system Login Page index.php cross site scriptingEPSS 0.5%CVE-2026-78054MEDIUMSourceCodester Class and Exam Timetabling System BSIS1.php cross site scriptingEPSS 0.5%CVE-2026-14656MEDIUMcode-projects Assessment Management remove-user.php cross site scriptingEPSS 0.5%CVE-2026-19378MEDIUMcode-projects Task Management System CommentSave.php cross site scriptingEPSS 0.5%CVE-2026-22390CRITICALWordPress Builderall Builder for WordPress plugin <= 3.0.1 - Remote Code Execution (RCE) vulnerabilityEPSS 0.5%CVE-2023-6604MEDIUMFfmpeg: hls xbin demuxer dos amplification in ffmpegEPSS 0.5%CVE-2026-3763MEDIUMcode-projects Simple Flight Ticket Booking System showhistory.php cross site scriptingEPSS 0.5%