Weaknesses of type CWE-94
4,442 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2026-30457CRITICALAn issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.EPSS 0.8%CVE-2026-30643CRITICALAn issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload.EPSS 0.8%CVE-2025-1613MEDIUMFiberHome AN5506-01A ONU GPON URL Filtering Submenu URL_filterCfg cross site scriptingEPSS 0.8%CVE-2026-55585HIGHQWED: Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`EPSS 0.8%CVE-2025-1614MEDIUMFiberHome AN5506-01A ONU GPON Port Forwarding Submenu portForwardingCfg cross site scriptingEPSS 0.8%CVE-2026-51974HIGHAn eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remoEPSS 0.8%CVE-2026-42396MEDIUMInsufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to FailEPSS 0.8%CVE-2026-2052HIGHWidget Options <= 4.2.2 - Authenticated (Contributor+) Remote Code Execution via Display LogicEPSS 0.8%CVE-2026-65880CRITICALJoomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3EPSS 0.8%CVE-2023-33229LOWSolarWinds Platform Incorrect Input Neutralization VulnerabilityEPSS 0.8%CVE-2024-51757CRITICALFixes security vulnerability that allowed for server side code to be executed by a <script> tagEPSS 0.8%CVE-2024-37845HIGHMangoOS before 5.2.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the Active Process Command feaEPSS 0.8%CVE-2026-4965MEDIUMletta-ai letta Incomplete Fix CVE-2025-6101 ast_parsers.py resolve_type eval injectionEPSS 0.8%CVE-2026-86793CRITICALCVE-2026-86793EPSS 0.8%CVE-2020-36875CRITICALAccessAlly < 3.3.2 Unauthenticated Arbitrary PHP Code ExecutionEPSS 0.8%CVE-2026-73487CRITICALFlowise before 3.1.3 Prompt Injection RCE via CSV AgentEPSS 0.8%CVE-2024-39071CRITICALFujian Kelixun <=7.6.6.4391 is vulnerable to SQL Injection in send_event.php.EPSS 0.8%CVE-2023-1482MEDIUMHkCms External Plugin code injectionEPSS 0.8%CVE-2026-44758CRITICALCode Injection vulnerability in Manufacturing Integration and IntelligenceEPSS 0.8%CVE-2026-41512CRITICALRemote code execution via JavaScript injection in `BrowserAutomation::PlaywrightService`EPSS 0.8%