Weaknesses of type CWE-94
4,474 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2024-29209MEDIUMA medium severity vulnerability has been identified in the update mechanism of the Phish Alert Button for Outlook, which could allow an attaEPSS 0.4%CVE-2025-1196MEDIUMcode-projects Real Estate Property Management System search.php cross site scriptingEPSS 0.4%CVE-2026-2150MEDIUMSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System checkin.php cross site scriptingEPSS 0.4%CVE-2026-2159MEDIUMSourceCodester Simple Responsive Tourism Website Registration Master.php cross site scriptingEPSS 0.4%CVE-2025-32596HIGHWordPress Real Estate Manager plugin <= 7.3 - Arbitrary Code Execution vulnerabilityEPSS 0.4%CVE-2026-2932MEDIUMYiFang CMS Extended Management D_adPosition.php update cross site scriptingEPSS 0.4%CVE-2025-3795MEDIUMDaiCuo SEO Optimization Settings Section cross site scriptingEPSS 0.4%CVE-2025-2213MEDIUMCastlenet CBW383G2N Wireless Menu wlanPrimaryNetwork.asp cross site scriptingEPSS 0.4%CVE-2024-10681MEDIUMARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.51 - Authenticated (Subscriber+) Arbitrary Shortcode ExecutionEPSS 0.4%CVE-2025-3163MEDIUMInternLM LMDeploy conf.py open code injectionEPSS 0.4%CVE-2022-43486MEDIUMHidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable EPSS 0.4%CVE-2025-6126MEDIUMPHPGurukul Rail Pass Management System contact.php cross site scriptingEPSS 0.4%CVE-2024-13928HIGHAuthenticated SQL InjectionEPSS 0.4%CVE-2025-2979MEDIUMWCMS Registration setregister cross site scriptingEPSS 0.4%CVE-2025-1159MEDIUMCampCodes School Management Software academic-calendar cross site scriptingEPSS 0.4%CVE-2025-0339MEDIUMcode-projects Online Bike Rental HTTP GET Request vehical-details.php cross site scriptingEPSS 0.4%CVE-2025-2371MEDIUMPHPGurukul Human Metapneumovirus Testing Management System Registered Mobile Number Search registered-user-testing.php cross site scriptingEPSS 0.4%CVE-2025-48100CRITICALWordPress bidorbuy Store Integrator plugin <= 2.12.0 - Remote Code Execution (RCE) vulnerabilityEPSS 0.4%CVE-2024-12843MEDIUMEmlog Pro plugin.php cross site scriptingEPSS 0.4%CVE-2024-28699HIGHA buffer overflow vulnerability in pdf2json v0.70 allows a local attacker to execute arbitrary code via the GString::copy() and ImgOutputDevEPSS 0.4%