Weaknesses of type CWE-94

4,475 results

Injeção de script

Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.

Example

Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.

How to mitigate

Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.

CVE-2026-8136MEDIUMSourceCodester Pharmacy Sales and Inventory System index.php users cross site scriptingEPSS 0.4%CVE-2025-9438MEDIUM1000projects Online Project Report Submission and Evaluation System add_student.php cross site scriptingEPSS 0.4%CVE-2026-8255MEDIUMDevs Palace ERP Online add_new_customer cross site scriptingEPSS 0.4%CVE-2026-4576MEDIUMcode-projects Exam Form Submission update_s5.php cross site scriptingEPSS 0.4%CVE-2026-6623MEDIUMBichitroGan ISP Billing Software Profile users-view cross site scriptingEPSS 0.4%CVE-2026-7296MEDIUMSourceCodester Pizzafy Ecommerce System ajax.php save_order cross site scriptingEPSS 0.4%CVE-2026-94211MEDIUMHyve5 Leantime Project Dashboard show.blade.php cross site scriptingEPSS 0.4%CVE-2026-4578MEDIUMcode-projects Exam Form Submission update_s3.php cross site scriptingEPSS 0.4%CVE-2026-7281MEDIUMSourceCodester Pharmacy Sales and Inventory System index.php supplier cross site scriptingEPSS 0.4%CVE-2025-10614MEDIUMitsourcecode E-Logbook with Health Monitoring System for COVID-19 print_reports_prev.php cross site scriptingEPSS 0.4%CVE-2026-4909MEDIUMcode-projects Exam Form Submission update_s7.php cross site scriptingEPSS 0.4%CVE-2026-4356MEDIUMitsourcecode University Management System add_result.php cross site scriptingEPSS 0.4%CVE-2025-55192HIGHHomeAssistant-Tapo-Control Code Injection Vulnerability in issues.yml WorkflowEPSS 0.4%CVE-2026-4616MEDIUMbolo-blog Article Title article cross site scriptingEPSS 0.4%CVE-2025-9440MEDIUM1000projects Online Project Report Submission and Evaluation System add_title.php cross site scriptingEPSS 0.4%CVE-2026-5836MEDIUMcode-projects Online Shoe Store admin_product.php cross site scriptingEPSS 0.4%CVE-2025-9439MEDIUM1000projects Online Project Report Submission and Evaluation System edit_faculty.php cross site scriptingEPSS 0.4%CVE-2026-6003MEDIUMcode-projects Simple IT Discussion Forum user.php cross site scriptingEPSS 0.4%CVE-2026-6624MEDIUMBichitroGan ISP Billing Software Pool List add cross site scriptingEPSS 0.4%CVE-2026-8219MEDIUMDevs Palace ERP Online supplier-save cross site scriptingEPSS 0.4%