Falhas do tipo CWE-94

4.476 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2026-13558MEDIUMCodeAstro Complaint Management System Report addreport cross site scriptingEPSS 0.3%CVE-2025-9656MEDIUMPHPGurukul Directory Management System add-directory.php cross site scriptingEPSS 0.3%CVE-2024-46963HIGHThe com.superfast.video.downloader (aka Super Unlimited Video Downloader - All in One) application through 5.1.9 for Android allows an attacEPSS 0.3%CVE-2024-46964HIGHThe com.video.downloader.all (aka All Video Downloader) application through 11.28 for Android allows an attacker to execute arbitrary JavaScEPSS 0.3%CVE-2025-1905MEDIUMSourceCodester Employee Management System employee.php cross site scriptingEPSS 0.3%CVE-2025-1904MEDIUMcode-projects Blood Bank System A+.php cross site scriptingEPSS 0.3%CVE-2025-2085MEDIUMStarSea99 starsea-mall save cross site scriptingEPSS 0.3%CVE-2022-50944HIGHAero CMS 0.0.1 PHP Code Injection via posts.phpEPSS 0.3%CVE-2025-2673MEDIUMcode-projects Payroll Management System home_employee.php cross site scriptingEPSS 0.3%CVE-2025-1532HIGHCode Injection Vulnerability in PhoneserviceEPSS 0.3%CVE-2024-46966HIGHThe Ikhgur mn.ikhgur.khotoch (aka Video Downloader Pro & Browser) application through 1.0.42 for Android allows an attacker to execute arbitEPSS 0.3%CVE-2025-9422MEDIUMoitcode samarium Team Image team cross site scriptingEPSS 0.3%CVE-2026-3720MEDIUM1024-lab/lab1024 SmartAdmin Notice notice-form-drawer.vue cross site scriptingEPSS 0.3%CVE-2025-9416MEDIUMoitcode samarium Pages Image webpage cross site scriptingEPSS 0.3%CVE-2026-3721MEDIUM1024-lab/lab1024 SmartAdmin Help Documentation HelpDocAddForm.java cross site scriptingEPSS 0.3%CVE-2026-9568LOWThingsBoard YAML provision getGatewayDockerComposeFile code injectionEPSS 0.3%CVE-2024-55580HIGHAn issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. Unprivileged users with network access may be able to EPSS 0.3%CVE-2026-5106MEDIUMcode-projects Exam Form Submission update_fst.php cross site scriptingEPSS 0.3%CVE-2025-7943MEDIUMPHPGurukul Taxi Stand Management System search-autoortaxi.php cross site scriptingEPSS 0.3%CVE-2025-10386MEDIUMYida ECMS Consulting Enterprise Management System POST Request login.do cross site scriptingEPSS 0.3%