Weaknesses of type CWE-94
4,495 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-33744HIGHBentoML has Dockerfile Command Injection via system_packages in bentofile.yamlEPSS 0.2%CVE-2025-24287MEDIUMA vulnerability allowing local system users to modify directory contents, allowing for arbitrary code execution on the local system with eleEPSS 0.2%CVE-2025-7857MEDIUMPHPGurukul Apartment Visitors Management System HTTP POST Request bwdates-passreports-details.php cross site scriptingEPSS 0.2%CVE-2025-7858MEDIUMPHPGurukul Apartment Visitors Management System HTTP POST Request admin-profile.php cross site scriptingEPSS 0.2%CVE-2026-85674HIGHaider 0.86.2 Remote Code Execution via .aider.conf.ymlEPSS 0.2%CVE-2025-15583MEDIUMdetronetdip E-commerce function.php get_safe_value cross site scriptingEPSS 0.2%CVE-2025-7791MEDIUMPHPGurukul Online Security Guards Hiring System search.php cross site scriptingEPSS 0.2%CVE-2025-13484MEDIUMCampcodes Complete Online Beauty Parlor Management System customer-list.php cross site scriptingEPSS 0.2%CVE-2026-11520MEDIUMSourceCodester Inventory System header.php cross site scriptingEPSS 0.2%CVE-2025-13584MEDIUMEigenfocus Description cross site scriptingEPSS 0.2%CVE-2025-13412MEDIUMCampcodes Retro Basketball Shoes Online Store admin_running.php cross site scriptingEPSS 0.2%CVE-2025-13232MEDIUMprojectsend File Editor/Custom Download Aliases cross site scriptingEPSS 0.2%CVE-2026-0642MEDIUMprojectworlds House Rental and Property Listing complaint.php cross site scriptingEPSS 0.2%CVE-2025-23312HIGHNVIDIA NeMo Framework for all platforms contains a vulnerability in the retrieval services component, where malicious data created by an attEPSS 0.2%CVE-2025-15219MEDIUMSohuTV CacheCloud MachineManageController.java doPodList cross site scriptingEPSS 0.2%CVE-2025-15204MEDIUMSohuTV CacheCloud QuartzManageController.java doQuartzList cross site scriptingEPSS 0.2%CVE-2025-2313CRITICALRCE via Print.pl in uhcPrintServerPrintEPSS 0.2%CVE-2025-7786MEDIUMGnuboard g6 Post Reply qa cross site scriptingEPSS 0.2%CVE-2025-7819MEDIUMPHPGurukul Apartment Visitors Management System HTTP POST Request create-pass.php cross site scriptingEPSS 0.2%CVE-2025-15203MEDIUMSohuTV CacheCloud ResourceController.java index cross site scriptingEPSS 0.2%