Weaknesses of type CWE-94

4,475 results

Injeção de script

Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.

Example

Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.

How to mitigate

Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.

CVE-2026-16156MEDIUMSourceCodester Class and Exam Timetabling System forexam.php cross site scriptingEPSS 0.3%CVE-2025-12290MEDIUMSui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 359 cross site scriptingEPSS 0.3%CVE-2026-90835MEDIUMmichaelliao itranswarp Page Content Rendering Markdown.java Markdown.toHtml cross site scriptingEPSS 0.3%CVE-2026-14752MEDIUMmjperpinosa stumasy add_into_dictionary.php add_definition cross site scriptingEPSS 0.3%CVE-2026-82482MEDIUMcoppermine-gallery Coppermine Photo Gallery edit_profile Endpoint profile.php cross site scriptingEPSS 0.3%CVE-2026-4175MEDIUMAureus ERP Chatter Message content-text-entry.blade.php cross site scriptingEPSS 0.3%CVE-2025-47481MEDIUMWordPress GS Testimonial Slider plugin <= 3.2.9 - Content Injection vulnerabilityEPSS 0.3%CVE-2026-93977MEDIUMcode-projects Assessment Management add-single-mark.php cross site scriptingEPSS 0.3%CVE-2025-12267MEDIUMabhicodebox ModernShop search cross site scriptingEPSS 0.3%CVE-2026-19230MEDIUMSourceCodester Photo Share Website Comment Input Box ajax.php save_upload cross site scriptingEPSS 0.3%CVE-2026-16203MEDIUMSourceCodester Class and Exam Timetabling System forCYS.php cross site scriptingEPSS 0.3%CVE-2026-93505MEDIUMSveltyCMS SVG Media Upload media-service.server.ts cross site scriptingEPSS 0.3%CVE-2026-90604MEDIUMTotolink A3002MU Anchor Tag cross site scriptingEPSS 0.3%CVE-2026-90528MEDIUMTDuckApp tduck-platform Form Write View index.vue cross site scriptingEPSS 0.3%CVE-2026-90696MEDIUMSourceCodester Inventory Management System Product Management products_handler.php cross site scriptingEPSS 0.3%CVE-2025-5713MEDIUMSoluçõesCoop iSoluçõesWEB Flow fluxos-dashboard cross site scriptingEPSS 0.3%CVE-2026-90695MEDIUMSourceCodester Inventory Management System Vendor Management vendors_handler.php cross site scriptingEPSS 0.3%CVE-2026-19922MEDIUMcode-projects Online Shopping System checkout.php cross site scriptingEPSS 0.3%CVE-2026-7501MEDIUMLinkStackOrg LinkStack UserController.php editPage cross site scriptingEPSS 0.3%CVE-2026-16202MEDIUMSourceCodester Class and Exam Timetabling System CYS.php cross site scriptingEPSS 0.3%