Weaknesses of type CWE-94
4,475 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2024-41304MEDIUMAn arbitrary file upload vulnerability in the uploadFileAction() function of WonderCMS v3.4.3 allows attackers to execute arbitrary code viaEPSS 0.4%CVE-2026-19223HIGHSmush < 4.3.2 - Admin+ Network-Wide RCE via Hub Connector on MultisiteEPSS 0.4%CVE-2025-11390MEDIUMPHPGurukul Cyber Cafe Management System POST Parameter search.php cross site scriptingEPSS 0.4%CVE-2025-13244MEDIUMcode-projects Student Information System register.php cross site scriptingEPSS 0.4%CVE-2025-6353MEDIUMcode-projects Responsive Blog search.php cross site scriptingEPSS 0.4%CVE-2025-0559MEDIUMCampcodes School Management Software Create Id Card Page create-id-card cross site scriptingEPSS 0.4%CVE-2025-8222MEDIUMjerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsController.java cross site scriptingEPSS 0.4%CVE-2025-0560MEDIUMCampCodes School Management Software Photo Gallery Page photo-gallery cross site scriptingEPSS 0.4%CVE-2024-13023MEDIUMPHPGurukul Maid Hiring Management System Search Maid Page search-maid.php cross site scriptingEPSS 0.4%CVE-2025-2699MEDIUMGetmeUK ContentTools Image cross site scriptingEPSS 0.4%CVE-2023-37273HIGHDocker escape in Auto-GPT when running from docker-compose.yml included in git repoEPSS 0.4%CVE-2025-22136HIGHTabby has a TCC Bypass via Misconfigured Node FusesEPSS 0.4%CVE-2026-34585HIGHSiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command executionEPSS 0.4%CVE-2025-0464MEDIUMSourceCodester Task Reminder System Maintenance Section cross site scriptingEPSS 0.4%CVE-2025-0537MEDIUMcode-projects Car Rental Management System manage-pages.php cross site scriptingEPSS 0.4%CVE-2026-4239MEDIUMLagom WHMCS Template Datatables prototype pollutionEPSS 0.4%CVE-2025-10411MEDIUMitsourcecode E-Logbook with Health Monitoring System for COVID-19 POST Request check_profile.php cross site scriptingEPSS 0.4%CVE-2024-13812MEDIUMAnps Theme plugin <= 1.1.1 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.4%CVE-2026-15311MEDIUMNousResearch hermes-agent Matrix Adapter matrix.py MatrixAdapter._markdown_to_html cross site scriptingEPSS 0.4%CVE-2026-73084MEDIUMActivepieces: Reflected Cross-Site Scripting in OAuth Redirect EndpointEPSS 0.4%