Weaknesses of type CWE-94
4,497 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-86320HIGHFlatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)EPSS 0.2%CVE-2022-41576HIGHThe rphone module has a script that can be maliciously modified.Successful exploitation of this vulnerability may cause irreversible programEPSS 0.2%CVE-2022-29815MEDIUMIn JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possibleEPSS 0.2%CVE-2026-33941HIGHHandlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and OptionsEPSS 0.2%CVE-2025-14205MEDIUMcode-projects Chamber of Commerce Membership Management System Your Info membership_profile.php cross site scriptingEPSS 0.2%CVE-2025-70341HIGHInsecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files.EPSS 0.2%CVE-2026-43961HIGHVim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code executionEPSS 0.2%CVE-2022-29813MEDIUMIn JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possibleEPSS 0.2%CVE-2026-71614HIGHAn issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/media_tools/dvb_mpe.c, deEPSS 0.2%CVE-2025-26238HIGHIn D-Link DI-8100G 17.12.20A1, the flag parameter in msp_info can be exploited to execute arbitrary code.EPSS 0.2%CVE-2025-7711MEDIUMClassified Listing – Classified ads & Business Directory Plugin <= 5.0.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Listing DescriptionEPSS 0.2%CVE-2024-56448MEDIUMVulnerability of improper access control in the home screen widget module
Impact: Successful exploitation of this vulnerability may affect aEPSS 0.2%CVE-2026-44244HIGHGitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPathEPSS 0.2%CVE-2026-11231HIGHInappropriate implementation in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary EPSS 0.2%CVE-2023-36923HIGHCode Injection vulnerability in SAP PowerDesignerEPSS 0.2%CVE-2026-41692MEDIUMi18nextify is vulnerable to DOM XSS via javascript:/data: URL schemes in translated href/src attributesEPSS 0.2%CVE-2024-3892HIGHLocal code execution vulnerability in Telerik UI for WinFormsEPSS 0.2%CVE-2025-13577MEDIUMPHPGurukul Hostel Management System register-complaint.php cross site scriptingEPSS 0.2%CVE-2026-2222MEDIUMcode-projects Online Reviewer System btn_functions.php cross site scriptingEPSS 0.2%CVE-2024-33225HIGHAn issue in the component RTKVHD64.sys of Realtek Semiconductor Corp Realtek(r) High Definition Audio Function Driver v6.0.9549.1 allows attEPSS 0.2%