Weaknesses of type CWE-94
4,482 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-12208MEDIUMjsonata-js jsonata Function Binding Frame System jsonata.js createFrame prototype pollutionEPSS 0.3%CVE-2025-7816MEDIUMPHPGurukul Apartment Visitors Management System HTTP POST Request visitor-detail.php cross site scriptingEPSS 0.3%CVE-2026-12209MEDIUMRubyLouvre avalon Template Filter index.js prototype pollutionEPSS 0.3%CVE-2025-3391MEDIUMhailey888 oa_system Backend AddrController. java outAddress cross site scriptingEPSS 0.3%CVE-2025-2878MEDIUMKentico CMS Additional Database Installation Wizard install.aspx cross site scriptingEPSS 0.3%CVE-2025-5151MEDIUMdefog-ai introspect analysis_tools.py execute_analysis_code_safely code injectionEPSS 0.3%CVE-2025-2366MEDIUMgougucms Add Department Page add cross site scriptingEPSS 0.3%CVE-2025-2616MEDIUMyangyouwang 杨有旺 crud 简约后台管理系统 Role Management Page cross site scriptingEPSS 0.3%CVE-2024-13196MEDIUMdonglight bookstore电商书城系统说明 BookInfoController.java BookSearchList cross site scriptingEPSS 0.3%CVE-2022-27537HIGHPotential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escEPSS 0.3%CVE-2025-69443MEDIUMRemote Code Execution in coleam00 Archon 0.1.0. A crafted HTML page, when accessed by a victim, can execute commands, run prompts on behalf EPSS 0.3%CVE-2025-4323MEDIUMMRCMS Edit Article Page cross site scriptingEPSS 0.3%CVE-2025-4326MEDIUMMRCMS Add Fragment Page add.do cross site scriptingEPSS 0.3%CVE-2024-11491MEDIUM115cms useradmin.html cross site scriptingEPSS 0.3%CVE-2025-4292MEDIUMMRCMS Edit User Page edit.do cross site scriptingEPSS 0.3%CVE-2025-4293MEDIUMMRCMS Group Edit Page edit.do cross site scriptingEPSS 0.3%CVE-2025-9959HIGHSandbox escape in smolagents Local Python execution environment via dunder attributesEPSS 0.3%CVE-2025-4324MEDIUMMRCMS External Link Management Page edit.do cross site scriptingEPSS 0.3%CVE-2026-42879MEDIUMFacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product ImagesEPSS 0.3%CVE-2025-10909MEDIUMMangati NovoSGA SVG File admin cross site scriptingEPSS 0.3%