Weaknesses of type CWE-94

4,466 results

Injeção de script

Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.

Example

Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.

How to mitigate

Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.

CVE-2026-5539MEDIUMcode-projects Simple Laundry System Parameter modifymember.php cross site scriptingEPSS 0.4%CVE-2026-4846MEDIUMdameng100 muucmf autoReply.html cross site scriptingEPSS 0.4%CVE-2026-90848MEDIUMGovernikus AusweisApp StartPAOSResponse cross site scriptingEPSS 0.4%CVE-2026-5826MEDIUMcode-projects Simple IT Discussion Forum edit-category.php cross site scriptingEPSS 0.4%CVE-2026-5015MEDIUMelecV2 elecV2P Endpoint logs cross site scriptingEPSS 0.4%CVE-2026-3610MEDIUMHSC Cybersecurity Mailinspector URL mliUserValidation.php cross site scriptingEPSS 0.4%CVE-2026-9418MEDIUMcode-projects Employee Management System changepassemp.php cross site scriptingEPSS 0.4%CVE-2026-4847MEDIUMdameng100 muucmf list.html cross site scriptingEPSS 0.4%CVE-2026-13536MEDIUMGotoHTTP reg.12x cross site scriptingEPSS 0.4%CVE-2026-15202MEDIUMYzmCMS Header yzmphp.php get_url cross site scriptingEPSS 0.4%CVE-2026-9519MEDIUMstonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scriptingEPSS 0.4%CVE-2026-6034MEDIUMcode-projects Vehicle Showroom Management System ProfitAndLossReport.php cross site scriptingEPSS 0.4%CVE-2026-5319MEDIUMitsourcecode Payroll Management System navbar.php cross site scriptingEPSS 0.4%CVE-2026-5630MEDIUMassafelovic gpt-researcher Report API app.py cross site scriptingEPSS 0.4%CVE-2026-6032MEDIUMcode-projects Simple Laundry System checkcheckout.php cross site scriptingEPSS 0.4%CVE-2026-9413MEDIUMSourceCodester Indian Invoicing System category.php cross site scriptingEPSS 0.4%CVE-2026-9417MEDIUMcode-projects Employee Management System myprofileup.php cross site scriptingEPSS 0.4%CVE-2026-7129MEDIUMSourceCodester Pharmacy Sales and Inventory System index.php cross site scriptingEPSS 0.4%CVE-2026-6159MEDIUMcode-projects Simple ChatBox Endpoint insert.php cross site scriptingEPSS 0.4%CVE-2026-86264MEDIUMsfturing ssm_pro Order Endpoint OrderController.java cross site scriptingEPSS 0.4%