Weaknesses of type CWE-94
4,497 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-61433HIGHPraisonAI before 4.6.78 Code Injection via API deployment generatorEPSS 0.2%CVE-2026-54655HIGH`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generatorEPSS 0.2%CVE-2026-11338MEDIUMSourceCodester Ship Ferry Ticket Reservation System manage_user cross site scriptingEPSS 0.2%CVE-2026-10529MEDIUMwestboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scriptingEPSS 0.2%CVE-2025-54940MEDIUMAn HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerability is exploited, crafEPSS 0.2%CVE-2026-8795HIGHA YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. The hostnamEPSS 0.2%CVE-2026-2214MEDIUMcode-projects for Plugin AdminAddAlbum.php cross site scriptingEPSS 0.2%CVE-2026-24764LOWOpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel DescriptionsEPSS 0.2%CVE-2026-35093HIGHLibinput: libinput: unauthorized code execution and information disclosure through lua bytecode pluginsEPSS 0.2%CVE-2026-10112MEDIUMsambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard cross site scriptingEPSS 0.2%CVE-2025-33239HIGHNVIDIA Megatron Bridge contains a vulnerability in a data merging tutorial, where malicious input could cause a code injection. A successfulEPSS 0.2%CVE-2026-2224MEDIUMcode-projects Online Reviewer System btn_functions.php cross site scriptingEPSS 0.2%CVE-2025-33240HIGHNVIDIA Megatron Bridge contains a vulnerability in a data shuffling tutorial, where malicious input could cause a code injection. A successfEPSS 0.2%CVE-2026-1146MEDIUMSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System api_register_patient.php cross site scriptingEPSS 0.2%CVE-2026-8539MEDIUMScript injection in SanitizerAPI in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to inject arbitrary scripts oEPSS 0.2%CVE-2025-7961MEDIUMKAP 3.6.0 - TCC BypassEPSS 0.2%CVE-2026-10245MEDIUMSourceCodester Pharmacy Sales and Inventory System main create_supplier cross site scriptingEPSS 0.2%CVE-2026-10244MEDIUMSourceCodester Pharmacy Sales and Inventory System main create_medicine_name cross site scriptingEPSS 0.2%CVE-2026-12130MEDIUMCodeAstro Human Resource Management System Projects Management Add_Projects cross site scriptingEPSS 0.2%CVE-2025-62348HIGHSalt junos module uses an unsafe YAML loader which may allow unintended code executionEPSS 0.2%