Weaknesses of type CWE-94
4,482 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2025-69443MEDIUMRemote Code Execution in coleam00 Archon 0.1.0. A crafted HTML page, when accessed by a victim, can execute commands, run prompts on behalf EPSS 0.3%CVE-2026-42879MEDIUMFacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product ImagesEPSS 0.3%CVE-2025-10909MEDIUMMangati NovoSGA SVG File admin cross site scriptingEPSS 0.3%CVE-2025-4326MEDIUMMRCMS Add Fragment Page add.do cross site scriptingEPSS 0.3%CVE-2025-4324MEDIUMMRCMS External Link Management Page edit.do cross site scriptingEPSS 0.3%CVE-2025-9959HIGHSandbox escape in smolagents Local Python execution environment via dunder attributesEPSS 0.3%CVE-2025-4292MEDIUMMRCMS Edit User Page edit.do cross site scriptingEPSS 0.3%CVE-2025-11421MEDIUMcode-projects Voting System candidates_edit.php cross site scriptingEPSS 0.3%CVE-2025-8555MEDIUMatjiu pybbs search cross site scriptingEPSS 0.3%CVE-2025-2715MEDIUMtimschofield webERP Confirm Dispatch and Invoice Page ConfirmDispatch_Invoice.php cross site scriptingEPSS 0.3%CVE-2026-14780HIGHPaperCut NG/MF: Remote Code Execution via Scripting SubsystemEPSS 0.3%CVE-2025-2124MEDIUMControl iD RH iD API change_password cross site scriptingEPSS 0.3%CVE-2025-2335MEDIUMDrivin Soluções API registerSchool cross site scriptingEPSS 0.3%CVE-2026-25366CRITICALWordPress Woody ad snippets plugin <= 2.7.1 - Remote Code Execution (RCE) vulnerabilityEPSS 0.3%CVE-2024-14020LOWcarboneio carbone Formatter input.js prototype pollutionEPSS 0.3%CVE-2024-45271HIGHMB connect line/Helmholz: Remote code execution due to improper input validationEPSS 0.3%CVE-2025-9716MEDIUMO2OA Personal Profile form cross site scriptingEPSS 0.3%CVE-2026-1509MEDIUMAvada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action ExecutionEPSS 0.3%CVE-2025-4257MEDIUMSeaCMS admin_pay.php cross site scriptingEPSS 0.3%CVE-2025-42947MEDIUMCode Injection vulnerability in SAP FICA ODN frameworkEPSS 0.3%