Weaknesses of type CWE-94
4,482 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2025-4257MEDIUMSeaCMS admin_pay.php cross site scriptingEPSS 0.3%CVE-2025-1617MEDIUMNetis WF2780 Wireless 2.4G Menu cross site scriptingEPSS 0.3%CVE-2025-7958HIGHA Code Injection vulnerability existed in Trellix Network Security CM and NX. A locally authenticated admin user can execute arbitrary code EPSS 0.3%CVE-2025-9929MEDIUMcode-projects Responsive Blog Site blogs_view.php cross site scriptingEPSS 0.3%CVE-2025-8785MEDIUMPortabilis i-Educar educar_usuario_lst.php cross site scriptingEPSS 0.3%CVE-2025-5764MEDIUMcode-projects Laundry System insert_laundry.php cross site scriptingEPSS 0.3%CVE-2025-8784MEDIUMPortabilis i-Educar Cadastrar Vínculo funcionario_vinculo_cad.php cross site scriptingEPSS 0.3%CVE-2026-90553HIGHvLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processorEPSS 0.3%CVE-2025-5757MEDIUMcode-projects Traffic Offense Reporting System save-reported.php cross site scriptingEPSS 0.3%CVE-2025-5765MEDIUMcode-projects Laundry System edit_laundry.php cross site scriptingEPSS 0.3%CVE-2025-2133MEDIUMftcms edit cross site scriptingEPSS 0.3%CVE-2025-7153MEDIUMCodeAstro Simple Hospital Management System POST Parameter doctor.html cross site scriptingEPSS 0.3%CVE-2025-4000MEDIUMSeeyon Zhiyuan OA Web Application System ssoproxy.jsp cross site scriptingEPSS 0.3%CVE-2025-53626MEDIUMpdfme has Sandbox Escape and Prototype Pollution vulnerabilities in pdfme expression evaluationEPSS 0.3%CVE-2025-3999MEDIUMSeeyon Zhiyuan OA Web Application System URL Parameter date.jsp cross site scriptingEPSS 0.3%CVE-2025-7866MEDIUMPortabilis i-Educar Disabilities Module educar_deficiencia_lst.php cross site scriptingEPSS 0.3%CVE-2025-1360MEDIUMInternet Web Solutions Sublime CRM HTTP POST Request inicio.php cross site scriptingEPSS 0.3%CVE-2021-3615MEDIUMA vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow code execution if a specific file exists on the attacheEPSS 0.3%CVE-2025-54731HIGHWordPress YouTube Showcase Plugin <= 3.5.1 - PHP Object Injection VulnerabilityEPSS 0.3%CVE-2024-37860HIGHBuffer Overflow vulnerability in Open Robotic Operating System 2 ROS2 navigation2- ROS2-humble&& navigation2-humble allows a local attacker EPSS 0.3%