r000t1ng/loja-integrada-xss
The Loja Integrada address widget sanitizes the cep parameter badly enough that a few dashes get a payload straight through.
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.