Weaknesses of type CWE-94
4,467 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-19932MEDIUMDefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injectionEPSS 0.4%CVE-2026-9302MEDIUM546669204 vps-inventory-monitoring VpsTest Console VpsTest.php eval code injectionEPSS 0.4%CVE-2024-12182MEDIUMDedeCMS soft_add.php cross site scriptingEPSS 0.4%CVE-2026-0500CRITICALRemote code execution in SAP Wily Introscope Enterprise Manager (WorkStation)EPSS 0.4%CVE-2026-90581MEDIUMcym1102 nginxWebUI autoUpdate MainController.autoUpdate code injectionEPSS 0.4%CVE-2025-3962MEDIUMwithstars Books-Management-System Comment add cross site scriptingEPSS 0.4%CVE-2025-3297MEDIUMSourceCodester Online Eyewear Shop Master.php cross site scriptingEPSS 0.4%CVE-2026-65804MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.4%CVE-2026-27984CRITICALWordPress Widget Options plugin <= 4.1.3 - Remote Code Execution (RCE) vulnerabilityEPSS 0.4%CVE-2024-11996MEDIUMcode-projects Farmacia editar-fornecedor.php cross site scriptingEPSS 0.4%CVE-2026-14691MEDIUMSourceCodester Multi-Vendor Online Grocery Management System Setting SystemSettings.php update_settings_info code injectionEPSS 0.4%CVE-2025-2583MEDIUMSimpleMachines SMF ManageNews.php cross site scriptingEPSS 0.4%CVE-2025-3961MEDIUMwithstars Books-Management-System do cross site scriptingEPSS 0.4%CVE-2024-12181MEDIUMDedeCMS SWF File uploads_add.php cross site scriptingEPSS 0.4%CVE-2025-3958MEDIUMwithstars Books-Management-System Book Edit Page book_edit_do.html cross site scriptingEPSS 0.4%CVE-2024-11078MEDIUMcode-projects Job Recruitment register.php cross site scriptingEPSS 0.4%CVE-2024-11997MEDIUMcode-projects Farmacia vendas.php cross site scriptingEPSS 0.4%CVE-2025-9433MEDIUMmtons mblog Admin Panel list cross site scriptingEPSS 0.4%CVE-2026-4564MEDIUMyangzongzhuan RuoYi Quartz Job job code injectionEPSS 0.4%CVE-2025-9680MEDIUMO2OA Personal Profile page cross site scriptingEPSS 0.4%