Weaknesses of type CWE-94
4,496 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2025-15203MEDIUMSohuTV CacheCloud ResourceController.java index cross site scriptingEPSS 0.2%CVE-2025-15204MEDIUMSohuTV CacheCloud QuartzManageController.java doQuartzList cross site scriptingEPSS 0.2%CVE-2025-14722MEDIUMvion707 DMadmin Backend AddonsController.class.php add cross site scriptingEPSS 0.2%CVE-2025-15024HIGHRCE in Yordam Informatics' Library Automation SystemEPSS 0.2%CVE-2025-23314HIGHNVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP component, where malicious data created by an attacker could cauEPSS 0.2%CVE-2026-55408HIGHKoodo Reader: Remote code execution via malicious epub fileEPSS 0.2%CVE-2026-75911HIGHCodeWhale before 0.8.64 Remote Code Execution via allow_shellEPSS 0.2%CVE-2025-12227MEDIUMprojectworlds Gate Pass Management System add-pass.php cross site scriptingEPSS 0.2%CVE-2025-8337MEDIUMcode-projects Simple Car Rental System add_vehicles.php cross site scriptingEPSS 0.2%CVE-2025-23315HIGHNVIDIA NeMo Framework for all platforms contains a vulnerability in the export and deploy component, where malicious data created by an attaEPSS 0.2%CVE-2025-15149MEDIUMrawchen ecms Add New Product updateProductServlet.java updateProductServlet cross site scriptingEPSS 0.2%CVE-2025-13795MEDIUMcodingWithElias School Management System Edit Student Info student-view.php cross site scriptingEPSS 0.2%CVE-2024-21571HIGHSnyk has identified a remote code execution (RCE) vulnerability in all versions of Code Agent. The vulnerability enables an attacker to execEPSS 0.2%CVE-2026-9762HIGHIBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user controlEPSS 0.2%CVE-2026-35255MEDIUMVulnerability in the Oracle Cloud Native Environment Command Line Interface product of Oracle Open Source Projects. The supported versions tEPSS 0.2%CVE-2025-10373MEDIUMPortabilis i-Educar educar_turma_tipo_cad.php cross site scriptingEPSS 0.2%CVE-2025-12264MEDIUMWisencode Create Support Ticket create cross site scriptingEPSS 0.2%CVE-2026-97896MEDIUMkrayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scriptingEPSS 0.2%CVE-2025-2981MEDIUMLegrand SMS PowerView cross site scriptingEPSS 0.2%CVE-2025-7868MEDIUMPortabilis i-Educar Calendar educar_calendario_dia_motivo_cad.php cross site scriptingEPSS 0.2%