Weaknesses of type CWE-79

30,469 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-27162MEDIUMDOM-based XSSEPSS 21.2%CVE-2025-66376HIGHZimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import dEPSS 20.2%KEVCVE-2024-55416LOWDevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on aEPSS 20.1%CVE-2023-4372MEDIUMLiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 19.5%CVE-2026-20945MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 19.1%CVE-2024-28739CRITICALAn issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter.EPSS 18.9%CVE-2024-1676CRITICALInappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to spoof security UI via a crafEPSS 18.8%CVE-2024-50339CRITICALGLPI vulnerable to unauthenticated session hijackingEPSS 18.7%CVE-2021-22874—Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in userlog-index.php via the `period_preset` parameter.EPSS 18.5%CVE-2021-22875—Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the `setPerPage` parameter.EPSS 18.5%CVE-2021-24275—Popup by Supsystic < 1.10.5 - Reflected Cross-Site scripting (XSS)EPSS 18.2%CVE-2021-24274—Ultimate Maps by Supsystic < 1.2.5 - Reflected Cross-Site scripting (XSS)EPSS 17.6%CVE-2022-27926MEDIUMA reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 alloEPSS 17.6%KEVCVE-2025-31121HIGHOpenEMR allows XSS in Patient Image featureEPSS 17.3%CVE-2022-4971MEDIUMSassy Social Share <= 3.3.3 - Reflected Cross-Site ScriptingEPSS 17.3%CVE-2025-52378MEDIUMCross-Site Scripting (XSS) vulnerability in Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below allowing attackers to inject JaEPSS 17.2%CVE-2025-55296MEDIUMLibreNMS allows stored XSS in Alert Template name fieldEPSS 17.0%CVE-2024-6931HIGHThe Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 16.7%CVE-2008-2991MEDIUMCross-site scripting (XSS) vulnerability in Adobe RoboHelp Server 6 and 7 allows remote attackers to inject arbitrary web script or HTML viaEPSS 16.5%CVE-2021-22888—Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of campaign-zone-zones.php. An attackEPSS 16.3%