Weaknesses of type CWE-94

4,475 results

Injeção de script

Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.

Example

Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.

How to mitigate

Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.

CVE-2026-8254MEDIUMDevs Palace ERP Online sales_save cross site scriptingEPSS 0.4%CVE-2026-8220MEDIUMDevs Palace ERP Online customer-save cross site scriptingEPSS 0.4%CVE-2025-9439MEDIUM1000projects Online Project Report Submission and Evaluation System edit_faculty.php cross site scriptingEPSS 0.4%CVE-2026-7090MEDIUMcode-projects Chat System send_message.php cross site scriptingEPSS 0.4%CVE-2025-10827MEDIUMPHPJabbers Restaurant Menu Maker preview.php cross site scriptingEPSS 0.4%CVE-2026-6622MEDIUMBichitroGan ISP Billing Software Customer edit cross site scriptingEPSS 0.4%CVE-2026-5834MEDIUMcode-projects Online Shoe Store admin_running.php cross site scriptingEPSS 0.4%CVE-2026-6003MEDIUMcode-projects Simple IT Discussion Forum user.php cross site scriptingEPSS 0.4%CVE-2026-6624MEDIUMBichitroGan ISP Billing Software Pool List add cross site scriptingEPSS 0.4%CVE-2026-4168MEDIUMTecnick TCExam Group tce_edit_group.php cross site scriptingEPSS 0.4%CVE-2026-5647MEDIUMcode-projects Online Shoe Store Add Product admin_feature.php cross site scriptingEPSS 0.4%CVE-2026-4169MEDIUMTecnick TCExam XML Export tce_xml_users.php F_xml_export_users cross site scriptingEPSS 0.4%CVE-2026-8136MEDIUMSourceCodester Pharmacy Sales and Inventory System index.php users cross site scriptingEPSS 0.4%CVE-2026-9608MEDIUMQianFox FoxCMS Administrator Backend edit cross site scriptingEPSS 0.4%CVE-2026-4909MEDIUMcode-projects Exam Form Submission update_s7.php cross site scriptingEPSS 0.4%CVE-2026-4595MEDIUMcode-projects Exam Form Submission update_s6.php cross site scriptingEPSS 0.4%CVE-2026-6184MEDIUMcode-projects Simple Content Management System welcome.php cross site scriptingEPSS 0.4%CVE-2025-9440MEDIUM1000projects Online Project Report Submission and Evaluation System add_title.php cross site scriptingEPSS 0.4%CVE-2026-6651MEDIUMerponline.xyz ERP Online Inventory Edit Item cross site scriptingEPSS 0.4%CVE-2026-4356MEDIUMitsourcecode University Management System add_result.php cross site scriptingEPSS 0.4%