Weaknesses of type CWE-94
4,448 resultsInjeção de script
Ocorre quando a aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados no contexto da aplicação, comprometendo dados, sessões ou o servidor.
Example
Um formulário web que avalia expressões matemáticas digitadas pelo usuário com eval() sem filtros. Um atacante entra 'os.system("rm -rf /")' em vez de "2+2", e o servidor executa o comando do sistema.
How to mitigate
Evite usar funções que executem código dinâmico (eval, exec, etc.) com entrada externa. Se inevitável, use sandboxing rigoroso, validação whitelist de entrada, e intérpretes isolados. Prefira APIs seguras que não interprem código arbitrário.
CVE-2025-3115CRITICALSpotfire Data Function VulnerabilityEPSS 0.7%CVE-2026-14602CRITICALRemote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query ParameterEPSS 0.7%CVE-2026-41507CRITICALRemote Code Execution (RCE) via String Literal Injection into math-codegenEPSS 0.7%CVE-2026-14289CRITICALWP FacturaONE < 5.37 - Unauthenticated Remote Code ExecutionEPSS 0.7%CVE-2026-15497MEDIUMSonicCloudOrg sonic-agent JWT Authentication Filter ExchangeController.java code injectionEPSS 0.7%CVE-2025-25467CRITICALInsufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating aEPSS 0.7%CVE-2026-73701CRITICALUnauthenticated Remote Code Execution in HPE Networking Fabric ComposerEPSS 0.7%CVE-2026-25587CRITICALSandboxJS has a Sandbox EscapeEPSS 0.7%CVE-2026-49143HIGHBrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP HandlerEPSS 0.7%CVE-2026-90999CRITICALSentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environmentEPSS 0.7%CVE-2026-56747HIGHCode Injection in JSON Pointer Processing Component in Cribl StreamEPSS 0.7%CVE-2019-14827—A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contextsEPSS 0.7%CVE-2026-4998MEDIUMSinaptik AI PandasAI Chat Message code_executor.py CodeExecutor.execute code injectionEPSS 0.7%CVE-2025-5150MEDIUMdocarray Web API torch_dataset.py __getitem__ prototype pollutionEPSS 0.7%CVE-2024-6940MEDIUMDedeCMS article_template_rand.php code injectionEPSS 0.7%CVE-2026-88856CRITICALJoomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7EPSS 0.7%CVE-2026-85192CRITICALJoomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.0EPSS 0.7%CVE-2025-5013MEDIUMHkCms Search index.html cross site scriptingEPSS 0.7%CVE-2026-78834HIGHA code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin. An authenticated low-privileged user who can modify page conEPSS 0.7%CVE-2026-93985CRITICALOpenPanel js-runtime JavaScript Template Sandbox Escape RCEEPSS 0.7%