Weaknesses of type CWE-94
4,482 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-90489MEDIUMXuxueli xxl-job insert cross site scriptingEPSS 0.3%CVE-2026-6619MEDIUMlanggenius dify ImagePreview image-preview.tsx openInNewTab cross site scriptingEPSS 0.3%CVE-2026-6162MEDIUMPHPGurukul Company Visitor Management System bwdates-reports-details.php cross site scriptingEPSS 0.3%CVE-2026-4973MEDIUMSourceCodester Online Quiz System add-question.php cross site scriptingEPSS 0.3%CVE-2026-90568MEDIUMmoxi624 Mogu Blog v2 blogSort Endpoint info.ftl BlogSortServiceImpl.addBlogSort cross site scriptingEPSS 0.3%CVE-2026-5325MEDIUMSourceCodester Simple Customer Relationship Management System Create Ticket create-ticket.php cross site scriptingEPSS 0.3%CVE-2026-94426MEDIUMxuxueli xxl-job insert cross site scriptingEPSS 0.3%CVE-2025-5543MEDIUMTOTOLINK X2000R Parent Controls Page cross site scriptingEPSS 0.3%CVE-2026-84437MEDIUMOpenCart Autocomplete Workflow address.php cross site scriptingEPSS 0.3%CVE-2026-3946MEDIUMPHPEMS index.php cross site scriptingEPSS 0.3%CVE-2025-5134MEDIUMTmall Demo Buy Item Page cross site scriptingEPSS 0.3%CVE-2026-5810MEDIUMSourceCodester Sales and Inventory System GET Parameter delete.php cross site scriptingEPSS 0.3%CVE-2025-2590MEDIUMcode-projects Human Resource Management System recruitment.go UpdateRecruitmentById cross site scriptingEPSS 0.3%CVE-2025-5628MEDIUMSourceCodester Food Menu Manager Add Menu index.php cross site scriptingEPSS 0.3%CVE-2025-12266MEDIUMZytec Dalian Zhuoyun Technology Central Authentication Service widget _empty code injectionEPSS 0.3%CVE-2025-7053MEDIUMCockpit save cross site scriptingEPSS 0.3%CVE-2025-8030HIGHPotential user-assisted code execution in “Copy as cURL” commandEPSS 0.3%CVE-2024-54529HIGHA logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An aEPSS 0.3%CVE-2025-6613MEDIUMPHPGurukul Hospital Management System manage-patient.php cross site scriptingEPSS 0.3%CVE-2025-2623MEDIUMwestboy CicadasCMS save cross site scriptingEPSS 0.3%