Falhas do tipo CWE-94

4.467 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2026-81719CRITICALopenssl_encrypt before 1.4.9 Remote Code Execution via PluginEPSS 0.4%CVE-2024-12001MEDIUMcode-projects Wazifa System Setting updatesettings.php cross site scriptingEPSS 0.4%CVE-2026-41414HIGHSkim: Arbitrary code execution via pull_request_target fork checkout in pr.ymlEPSS 0.4%CVE-2023-50808CRITICALZimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI.EPSS 0.4%CVE-2024-12000MEDIUMcode-projects Blood Bank System Setting updatesettings.php cross site scriptingEPSS 0.4%CVE-2024-12183MEDIUMDedeCMS HTTP POST Request carbuyaction.php RemoveXSS cross site scriptingEPSS 0.4%CVE-2026-14383HIGHInappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandEPSS 0.4%CVE-2026-9938HIGHInappropriate implementation in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sanEPSS 0.4%CVE-2026-14407HIGHInappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandEPSS 0.4%CVE-2026-17922HIGHInappropriate implementation in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code via aEPSS 0.4%CVE-2024-37382MEDIUMAn issue discovered in import host feature in Ab Initio Metadata Hub and Authorization Gateway before 4.3.1.1 allows attackers to run arbitrEPSS 0.4%CVE-2025-2049MEDIUMcode-projects Blood Bank System AB+.php cross site scriptingEPSS 0.4%CVE-2026-2546MEDIUMLigeroSmart index.pl cross site scriptingEPSS 0.4%CVE-2024-3931MEDIUMTotara LMS User Selector check.php cross site scriptingEPSS 0.4%CVE-2025-10394MEDIUMfcba_zzm ics-park Smart Park Management System Scheduled Task JobController.java code injectionEPSS 0.4%CVE-2026-41282MEDIUMProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untruEPSS 0.4%CVE-2026-2547MEDIUMLigeroSmart index.pl AgentDashboard cross site scriptingEPSS 0.4%CVE-2025-1957MEDIUMcode-projects Blood Bank System o+.php cross site scriptingEPSS 0.4%CVE-2025-5133MEDIUMTmall Demo Search Box cross site scriptingEPSS 0.4%CVE-2024-12665MEDIUMruifang-tech Rebuild Task Comment Attachment Upload cross site scriptingEPSS 0.4%