Falhas do tipo CWE-94

4.476 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2024-42041HIGHThe com.videodownload.browser.videodownloader (aka AppTool-Browser-Video All Video Downloader) application 20-30.05.24 for Android allows anEPSS 0.3%CVE-2025-10386MEDIUMYida ECMS Consulting Enterprise Management System POST Request login.do cross site scriptingEPSS 0.3%CVE-2026-2825MEDIUMrachelos WeRSS we-mp-rss Article fix.py fix_html cross site scriptingEPSS 0.3%CVE-2025-11291MEDIUMixmaps website2017 HTTP GET Request map.php cross site scriptingEPSS 0.3%CVE-2025-11306MEDIUMqianfox FoxCMS Search cross site scriptingEPSS 0.3%CVE-2025-67031MEDIUMORSEE (Online Recruitment System for Economic Experiments) 3.1.0 contains an authenticated Remote Code Execution vulnerability in the particEPSS 0.3%CVE-2026-5332MEDIUMXiaopi Panel WAF Firewall demo.php cross site scriptingEPSS 0.3%CVE-2025-5725MEDIUMSourceCodester Student Result Management System Grading System Page grading-system cross site scriptingEPSS 0.3%CVE-2025-6131MEDIUMCodeAstro Food Ordering System POST Request Parameter edit cross site scriptingEPSS 0.3%CVE-2026-18287HIGHAeon load_time_series_segmentation_benchmark Code Injection Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-5722MEDIUMSourceCodester Student Result Management System Add Academic Term terms cross site scriptingEPSS 0.3%CVE-2025-6477MEDIUMSourceCodester Student Result Management System System Settings Page system cross site scriptingEPSS 0.3%CVE-2025-5723MEDIUMSourceCodester Student Result Management System Classes Page classes cross site scriptingEPSS 0.3%CVE-2024-13557MEDIUMShortcodes by United Themes <= 5.1.6 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.3%CVE-2026-18286HIGHAeon load_human_activity_segmentation_datasets Code Injection Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-14928HIGHHugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution VulnerabilityEPSS 0.3%CVE-2024-53382MEDIUMPrism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly coEPSS 0.3%CVE-2025-14927HIGHHugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-5724MEDIUMSourceCodester Student Result Management System Subjects Page subjects cross site scriptingEPSS 0.3%CVE-2025-14926HIGHHugging Face Transformers SEW convert_config Code Injection Remote Code Execution VulnerabilityEPSS 0.3%