Weaknesses of type CWE-94
4,467 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2024-12001MEDIUMcode-projects Wazifa System Setting updatesettings.php cross site scriptingEPSS 0.4%CVE-2024-37382MEDIUMAn issue discovered in import host feature in Ab Initio Metadata Hub and Authorization Gateway before 4.3.1.1 allows attackers to run arbitrEPSS 0.4%CVE-2023-50808CRITICALZimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI.EPSS 0.4%CVE-2024-12000MEDIUMcode-projects Blood Bank System Setting updatesettings.php cross site scriptingEPSS 0.4%CVE-2024-12183MEDIUMDedeCMS HTTP POST Request carbuyaction.php RemoveXSS cross site scriptingEPSS 0.4%CVE-2026-14383HIGHInappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandEPSS 0.4%CVE-2026-9938HIGHInappropriate implementation in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sanEPSS 0.4%CVE-2026-17922HIGHInappropriate implementation in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code via aEPSS 0.4%CVE-2026-14407HIGHInappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandEPSS 0.4%CVE-2026-41414HIGHSkim: Arbitrary code execution via pull_request_target fork checkout in pr.ymlEPSS 0.4%CVE-2026-81719CRITICALopenssl_encrypt before 1.4.9 Remote Code Execution via PluginEPSS 0.4%CVE-2025-2049MEDIUMcode-projects Blood Bank System AB+.php cross site scriptingEPSS 0.4%CVE-2025-10394MEDIUMfcba_zzm ics-park Smart Park Management System Scheduled Task JobController.java code injectionEPSS 0.4%CVE-2026-2546MEDIUMLigeroSmart index.pl cross site scriptingEPSS 0.4%CVE-2026-41282MEDIUMProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untruEPSS 0.4%CVE-2026-2547MEDIUMLigeroSmart index.pl AgentDashboard cross site scriptingEPSS 0.4%CVE-2024-3931MEDIUMTotara LMS User Selector check.php cross site scriptingEPSS 0.4%CVE-2020-15167HIGHArbitrary code execution via configuration file in MillerEPSS 0.4%CVE-2025-1957MEDIUMcode-projects Blood Bank System o+.php cross site scriptingEPSS 0.4%CVE-2024-12665MEDIUMruifang-tech Rebuild Task Comment Attachment Upload cross site scriptingEPSS 0.4%