Weaknesses of type CWE-94

4,475 results

Injeção de script

Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.

Example

Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.

How to mitigate

Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.

CVE-2026-94211MEDIUMHyve5 Leantime Project Dashboard show.blade.php cross site scriptingEPSS 0.4%CVE-2026-5643MEDIUMCyber-III Student-Management-System Admin Add Endpoint notice.php cross site scriptingEPSS 0.4%CVE-2026-6622MEDIUMBichitroGan ISP Billing Software Customer edit cross site scriptingEPSS 0.4%CVE-2026-6184MEDIUMcode-projects Simple Content Management System welcome.php cross site scriptingEPSS 0.4%CVE-2026-8220MEDIUMDevs Palace ERP Online customer-save cross site scriptingEPSS 0.4%CVE-2025-9439MEDIUM1000projects Online Project Report Submission and Evaluation System edit_faculty.php cross site scriptingEPSS 0.4%CVE-2026-8254MEDIUMDevs Palace ERP Online sales_save cross site scriptingEPSS 0.4%CVE-2026-4595MEDIUMcode-projects Exam Form Submission update_s6.php cross site scriptingEPSS 0.4%CVE-2026-5836MEDIUMcode-projects Online Shoe Store admin_product.php cross site scriptingEPSS 0.4%CVE-2026-3171MEDIUMSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System queue.php cross site scriptingEPSS 0.3%CVE-2024-36120HIGHjavascript-deobfuscator crafted payload can lead to code executionEPSS 0.3%CVE-2025-1548MEDIUMiteachyou Dreamer CMS edit cross site scriptingEPSS 0.3%CVE-2026-90604MEDIUMTotolink A3002MU Anchor Tag cross site scriptingEPSS 0.3%CVE-2026-16156MEDIUMSourceCodester Class and Exam Timetabling System forexam.php cross site scriptingEPSS 0.3%CVE-2026-19230MEDIUMSourceCodester Photo Share Website Comment Input Box ajax.php save_upload cross site scriptingEPSS 0.3%CVE-2025-6345MEDIUMSourceCodester My Food Recipe Add Recipe Page add-recipe.php addRecipeModal cross site scriptingEPSS 0.3%CVE-2026-14791MEDIUMcrater-invoice-inc crater Invoice Note InvoicesRequest.php getFormattedString cross site scriptingEPSS 0.3%CVE-2026-15678MEDIUMcode-projects Online Job Portal DetailJob.php cross site scriptingEPSS 0.3%CVE-2026-19922MEDIUMcode-projects Online Shopping System checkout.php cross site scriptingEPSS 0.3%CVE-2026-90567MEDIUMquequnlong shiyi-blog Search index.vue highlightKeyword cross site scriptingEPSS 0.3%