Weaknesses of type CWE-94
4,469 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2025-11112MEDIUMPHPGurukul Employee Record Management System myprofile.php cross site scriptingEPSS 0.4%CVE-2025-1830MEDIUMzj1983 zz Customer Information cross site scriptingEPSS 0.4%CVE-2025-12335MEDIUMcode-projects E-Commerce Website supplier_update.php cross site scriptingEPSS 0.4%CVE-2024-13793HIGHWolmart | Multi-Vendor Marketplace WooCommerce Theme <= 1.8.11 - Unauthenticated Arbitrary Shortcode Execution in wolmart_loadmoreEPSS 0.4%CVE-2025-10063MEDIUMitsourcecode POS Point of Sale System deferred_table.php cross site scriptingEPSS 0.4%CVE-2025-11119MEDIUMitsourcecode Hostel Management System POST Request index.php cross site scriptingEPSS 0.4%CVE-2025-12244MEDIUMcode-projects Simple E-Banking System register.php cross site scriptingEPSS 0.4%CVE-2025-10065MEDIUMitsourcecode POS Point of Sale System dom_data_th.php cross site scriptingEPSS 0.4%CVE-2025-12333MEDIUMcode-projects E-Commerce Website supplier_add.php cross site scriptingEPSS 0.4%CVE-2025-12299MEDIUMcode-projects Simple Food Ordering System addproduct.php cross site scriptingEPSS 0.4%CVE-2025-10605MEDIUMPortabilis i-Educar agenda_preferencias.php cross site scriptingEPSS 0.4%CVE-2025-10067MEDIUMitsourcecode POS Point of Sale System empty_table.php cross site scriptingEPSS 0.4%CVE-2025-10066MEDIUMitsourcecode POS Point of Sale System dymanic_table.php cross site scriptingEPSS 0.4%CVE-2025-12300MEDIUMcode-projects Simple Food Ordering System addcategory.php cross site scriptingEPSS 0.4%CVE-2026-37630HIGHAn issue in QuickJS-NG v.0.12.1 allows an attacker to execute arbitrary code via the js_mapped_arguments_mark functionEPSS 0.4%CVE-2025-10993MEDIUMMuYuCMS Template Management admin.php code injectionEPSS 0.4%CVE-2025-11512MEDIUMcode-projects Voting System voters_add.php cross site scriptingEPSS 0.4%CVE-2025-10606MEDIUMPortabilis i-Educar ConfiguracaoMovimentoGeral cross site scriptingEPSS 0.4%CVE-2025-9773MEDIUMRemoteClinic edit.php cross site scriptingEPSS 0.4%CVE-2025-10064MEDIUMitsourcecode POS Point of Sale System dom_data_two_headers.php cross site scriptingEPSS 0.4%