Weaknesses of type CWE-94
4,483 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-24871CRITICALCode injection in Minecraft-Rcon-ManageEPSS 0.3%CVE-2025-8545MEDIUMPortabilis i-Educar educar_motivo_afastamento_cad.php cross site scriptingEPSS 0.3%CVE-2025-8920MEDIUMPortabilis i-Diario Dicionário de Termos BNCC dicionario-de-termos-bncc cross site scriptingEPSS 0.3%CVE-2025-7140MEDIUMSourceCodester Best Salon Management System Update Staff Page edit-staff.php cross site scriptingEPSS 0.3%CVE-2025-10234MEDIUMScada-LTS Data Point Edit data_point_edit.shtm cross site scriptingEPSS 0.3%CVE-2025-8544MEDIUMPortabilis i-Educar edit cross site scriptingEPSS 0.3%CVE-2025-10235MEDIUMScada-LTS Reports reports.shtm cross site scriptingEPSS 0.3%CVE-2025-2191MEDIUMClaro A7600-A1 Ping6 Diagnóstico form2pingv6.cgi cross site scriptingEPSS 0.3%CVE-2025-2617MEDIUMyangyouwang 杨有旺 crud 简约后台管理系统 Department Page cross site scriptingEPSS 0.3%CVE-2025-5523MEDIUMenilu web-flash File Upload upload fileService.upload cross site scriptingEPSS 0.3%CVE-2026-54271HIGHprotobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor namesEPSS 0.3%CVE-2025-5973MEDIUMPHPGurukul Restaurant Table Booking System add-table.php cross site scriptingEPSS 0.3%CVE-2025-9096MEDIUMExpressGateway express-gateway REST Endpoint apps.js cross site scriptingEPSS 0.3%CVE-2025-15200MEDIUMSohuTV CacheCloud AppClientDataShowController.java doIndex cross site scriptingEPSS 0.3%CVE-2025-3389MEDIUMhailey888 oa_system Backend InformManageController.java testMess cross site scriptingEPSS 0.3%CVE-2025-5972MEDIUMPHPGurukul Restaurant Table Booking System manage-subadmins.php cross site scriptingEPSS 0.3%CVE-2025-3390MEDIUMhailey888 oa_system Backend DaymanageController.java addandchangeday cross site scriptingEPSS 0.3%CVE-2025-3392MEDIUMhailey888 oa_system Backend MailController.java save cross site scriptingEPSS 0.3%CVE-2025-5879MEDIUMWuKongOpenSource WukongCRM File Upload AdminSysConfigController.java cross site scriptingEPSS 0.3%CVE-2024-37846CRITICALMangoOS before 5.2.0 was discovered to contain a Client-Side Template Injection (CSTI) vulnerability via the Platform Management Edit page.EPSS 0.3%