Weaknesses of type CWE-94
4,474 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-2897MEDIUMfunadmin Backend index.html cross site scriptingEPSS 0.4%CVE-2025-9147MEDIUMjasonclark getsemantic index.php cross site scriptingEPSS 0.4%CVE-2025-68015CRITICALWordPress Event Tickets with Ticket Scanner plugin <= 2.8.5 - Remote Code Execution (RCE) vulnerabilityEPSS 0.4%CVE-2025-15144MEDIUMdayrui XunRuiCMS JSONP Callback Init.php dr_exit_msg cross site scriptingEPSS 0.4%CVE-2025-4325MEDIUMMRCMS Category Management Page add.do cross site scriptingEPSS 0.4%CVE-2026-31253HIGHThe flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserializatioEPSS 0.4%CVE-2026-31251HIGHCosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in EPSS 0.4%CVE-2026-19224HIGHHummingbird < 3.21.2 - Admin+ Network-Wide RCE via Hub Connector on MultisiteEPSS 0.4%CVE-2026-100856HIGHAzuraCast before 0.23.6 Code Injection via Remote Relay PasswordEPSS 0.4%CVE-2026-3170MEDIUMSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System patient-search.php cross site scriptingEPSS 0.4%CVE-2026-94016MEDIUMSourceCodester Drug Recommendation System add_symptom cross site scriptingEPSS 0.4%CVE-2026-93975MEDIUMcode-projects Assessment Management User Editing edit-user.php cross site scriptingEPSS 0.4%CVE-2026-19207MEDIUMPHPGurukul Company Visitor Management System manage-newvisitors.php cross site scriptingEPSS 0.4%CVE-2025-10710MEDIUM07FLYCMS/07FLY-CMS/07FlyCRM index.php cross site scriptingEPSS 0.4%CVE-2026-2830MEDIUMWP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath'EPSS 0.4%CVE-2026-7269MEDIUMSourceCodester Pharmacy Sales and Inventory System index.php cross site scriptingEPSS 0.4%CVE-2026-19904MEDIUMSourceCodester Online Book Store System System Settings index.php site_settings cross site scriptingEPSS 0.4%CVE-2025-10711MEDIUM07FLYCMS/07FLY-CMS/07FlyCRM Login cross site scriptingEPSS 0.4%CVE-2026-15532MEDIUMSourceCodester Online Book Store System User Management cross site scriptingEPSS 0.4%CVE-2026-4474MEDIUMitsourcecode University Management System admin_single_student_update.php cross site scriptingEPSS 0.4%