Fallos del tipo CWE-94

4461 resultados

Injeção de script

A aplicação executa código dinâmico (JavaScript, Python, etc.) construído a partir de entrada do usuário sem validação ou sanitização adequada. Um atacante injeta comandos maliciosos que são interpretados e executados pelo servidor ou navegador como se fossem parte legítima do programa.

Ejemplo

Um formulário de contato concatena o nome do usuário diretamente em um script JavaScript enviado ao navegador: `<script>var usuario = '` + entrada_usuario + `';</script>`. Se o usuário envia `'; alert('xss'); //`, o navegador executa o alerta indesejado.

Cómo mitigar

Nunca construa código dinâmico a partir de entrada de usuário. Use APIs seguras (como `JSON.parse()` ao invés de `eval()`, ou templates com escape automático), valide e sanitize rigorosamente todas as entradas, e aplique listas brancas de caracteres permitidos quando possível.

CVE-2025-67034HIGHLantronix EDS5000, G520, and X300 OS Command InjectionEPSS 0.5%CVE-2025-59251HIGHMicrosoft Edge (Chromium-based) Remote Code Execution VulnerabilityEPSS 0.5%CVE-2025-65854CRITICALInsecure permissions in the scheduled tasks feature of MineAdmin v3.x allows attackers to execute arbitrary commands and execute a full accoEPSS 0.5%CVE-2026-36458CRITICALChestnutCMS v1.5.10 has a SQL injection vulnerability. The content parameter of the cms_content tag can be manipulated in the admin backend EPSS 0.5%CVE-2026-48962HIGHIO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output globEPSS 0.5%CVE-2024-8254MEDIUMEmail Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode ExecutionEPSS 0.5%CVE-2024-12893MEDIUMPortabilis i-Educar Tipo de Usuário Page 2 cross site scriptingEPSS 0.5%CVE-2024-23278HIGHThe issue was addressed with improved checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14EPSS 0.5%CVE-2025-2061MEDIUMcode-projects Online Ticket Reservation System passenger.php cross site scriptingEPSS 0.5%CVE-2025-0134MEDIUMCortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VMEPSS 0.5%CVE-2024-12421MEDIUMCoupon Affiliates – Affiliate Plugin for WooCommerce <= 5.16.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site ScriptingEPSS 0.5%CVE-2023-5512MEDIUMImproper Control of Generation of Code ('Code Injection') in GitLabEPSS 0.5%CVE-2025-2210MEDIUMaitangbao springboot-manager add cross site scriptingEPSS 0.5%CVE-2026-33310HIGHIntake has a Command Injection via shell() Expansion in Parameter DefaultsEPSS 0.5%CVE-2025-2209MEDIUMaitangbao springboot-manager add cross site scriptingEPSS 0.5%CVE-2025-2803HIGHSo-Called Air Quotes <= 0.1 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.5%CVE-2025-2211MEDIUMaitangbao springboot-manager add cross site scriptingEPSS 0.5%CVE-2026-45261CRITICALGitButler: Link injection via forge integration enables arbitrary script executionEPSS 0.5%CVE-2025-8370MEDIUMPortabilis i-Educar educar_escolaridade_lst.php cross site scriptingEPSS 0.5%CVE-2023-39956MEDIUMElectron: Out-of-package code execution when launched with arbitrary cwdEPSS 0.5%