Falhas do tipo CWE-94

4.474 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2025-41362MEDIUMCode injection vulnerability in IDF and ZLFEPSS 0.4%CVE-2026-2150MEDIUMSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System checkin.php cross site scriptingEPSS 0.4%CVE-2024-29209MEDIUMA medium severity vulnerability has been identified in the update mechanism of the Phish Alert Button for Outlook, which could allow an attaEPSS 0.4%CVE-2025-32596HIGHWordPress Real Estate Manager plugin <= 7.3 - Arbitrary Code Execution vulnerabilityEPSS 0.4%CVE-2025-1196MEDIUMcode-projects Real Estate Property Management System search.php cross site scriptingEPSS 0.4%CVE-2022-43486MEDIUMHidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable EPSS 0.4%CVE-2025-2213MEDIUMCastlenet CBW383G2N Wireless Menu wlanPrimaryNetwork.asp cross site scriptingEPSS 0.4%CVE-2026-2932MEDIUMYiFang CMS Extended Management D_adPosition.php update cross site scriptingEPSS 0.4%CVE-2025-3163MEDIUMInternLM LMDeploy conf.py open code injectionEPSS 0.4%CVE-2025-3795MEDIUMDaiCuo SEO Optimization Settings Section cross site scriptingEPSS 0.4%CVE-2024-10681MEDIUMARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.51 - Authenticated (Subscriber+) Arbitrary Shortcode ExecutionEPSS 0.4%CVE-2025-6126MEDIUMPHPGurukul Rail Pass Management System contact.php cross site scriptingEPSS 0.4%CVE-2025-1159MEDIUMCampCodes School Management Software academic-calendar cross site scriptingEPSS 0.4%CVE-2025-2979MEDIUMWCMS Registration setregister cross site scriptingEPSS 0.4%CVE-2024-13928HIGHAuthenticated SQL InjectionEPSS 0.4%CVE-2025-2371MEDIUMPHPGurukul Human Metapneumovirus Testing Management System Registered Mobile Number Search registered-user-testing.php cross site scriptingEPSS 0.4%CVE-2024-28699HIGHA buffer overflow vulnerability in pdf2json v0.70 allows a local attacker to execute arbitrary code via the GString::copy() and ImgOutputDevEPSS 0.4%CVE-2024-12843MEDIUMEmlog Pro plugin.php cross site scriptingEPSS 0.4%CVE-2025-0339MEDIUMcode-projects Online Bike Rental HTTP GET Request vehical-details.php cross site scriptingEPSS 0.4%CVE-2025-48100CRITICALWordPress bidorbuy Store Integrator plugin <= 2.12.0 - Remote Code Execution (RCE) vulnerabilityEPSS 0.4%