Falhas do tipo CWE-94

4.497 resultados

Injeção de script

Ocorre quando a aplicação constrói e executa código (JavaScript, Python, shell, etc.) usando dados não validados fornecidos pelo usuário. O atacante consegue injetar comandos arbitrários que serão executados com os privilégios da aplicação, comprometendo a segurança e integridade do sistema.

Exemplo

Um formulário que avalia expressões matemáticas recebidas do usuário: se a entrada é concatenada direto em um eval() ou equivalente, um atacante pode passar `__import__('os').system('rm -rf /')` em vez de uma expressão legítima, executando comandos do sistema.

Como mitigar

Nunca execute código construído a partir de entrada do usuário. Use parsers/validadores que aceitam apenas formatos esperados (whitelist), sandboxes para execução controlada, ou bibliotecas seguras que não avaliam código dinâmico. Se inevitável, isole rigidamente o ambiente de execução.

CVE-2026-11338MEDIUMSourceCodester Ship Ferry Ticket Reservation System manage_user cross site scriptingEPSS 0.2%CVE-2026-10529MEDIUMwestboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scriptingEPSS 0.2%CVE-2026-2156MEDIUMcode-projects Online Student Management System Announcement Management index.php cross site scriptingEPSS 0.2%CVE-2026-54655HIGH`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generatorEPSS 0.2%CVE-2026-8795HIGHA YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. The hostnamEPSS 0.2%CVE-2025-54940MEDIUMAn HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerability is exploited, crafEPSS 0.2%CVE-2026-2214MEDIUMcode-projects for Plugin AdminAddAlbum.php cross site scriptingEPSS 0.2%CVE-2026-24764LOWOpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel DescriptionsEPSS 0.2%CVE-2026-10112MEDIUMsambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard cross site scriptingEPSS 0.2%CVE-2026-35093HIGHLibinput: libinput: unauthorized code execution and information disclosure through lua bytecode pluginsEPSS 0.2%CVE-2025-33239HIGHNVIDIA Megatron Bridge contains a vulnerability in a data merging tutorial, where malicious input could cause a code injection. A successfulEPSS 0.2%CVE-2026-1146MEDIUMSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System api_register_patient.php cross site scriptingEPSS 0.2%CVE-2026-2224MEDIUMcode-projects Online Reviewer System btn_functions.php cross site scriptingEPSS 0.2%CVE-2025-33240HIGHNVIDIA Megatron Bridge contains a vulnerability in a data shuffling tutorial, where malicious input could cause a code injection. A successfEPSS 0.2%CVE-2025-7961MEDIUMKAP 3.6.0 - TCC BypassEPSS 0.2%CVE-2026-8539MEDIUMScript injection in SanitizerAPI in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to inject arbitrary scripts oEPSS 0.2%CVE-2025-33204HIGHNVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP and LLM components, where malicious data created by an attacker EPSS 0.2%CVE-2026-10244MEDIUMSourceCodester Pharmacy Sales and Inventory System main create_medicine_name cross site scriptingEPSS 0.2%CVE-2026-10234MEDIUMMettle sendportal Campaign webview cross site scriptingEPSS 0.2%CVE-2026-12130MEDIUMCodeAstro Human Resource Management System Projects Management Add_Projects cross site scriptingEPSS 0.2%