Weaknesses of type CWE-79

28,456 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-28739CRITICALAn issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter.EPSS 18.9%CVE-2024-1676CRITICALInappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to spoof security UI via a crafEPSS 18.8%CVE-2014-2120MEDIUMCross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackerEPSS 18.8%KEVCVE-2024-50339CRITICALGLPI vulnerable to unauthenticated session hijackingEPSS 18.7%CVE-2021-22874—Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in userlog-index.php via the `period_preset` parameter.EPSS 18.2%CVE-2021-22875—Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the `setPerPage` parameter.EPSS 18.2%CVE-2021-24275—Popup by Supsystic < 1.10.5 - Reflected Cross-Site scripting (XSS)EPSS 18.2%CVE-2024-11182MEDIUMStored XSS vulnerability in MDaemon Email ServerEPSS 17.7%KEVCVE-2018-19943HIGHIf exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these isEPSS 17.7%KEVCVE-2021-24274—Ultimate Maps by Supsystic < 1.2.5 - Reflected Cross-Site scripting (XSS)EPSS 17.6%CVE-2022-27926MEDIUMA reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 alloEPSS 17.6%KEVCVE-2025-31121HIGHOpenEMR allows XSS in Patient Image featureEPSS 17.3%CVE-2025-8155MEDIUMD-Link DCS-6010L Management Application vb.htm cross site scriptingEPSS 17.3%CVE-2023-4372MEDIUMLiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 16.8%CVE-2024-6931HIGHThe Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 16.7%CVE-2008-2991MEDIUMCross-site scripting (XSS) vulnerability in Adobe RoboHelp Server 6 and 7 allows remote attackers to inject arbitrary web script or HTML viaEPSS 16.5%CVE-2021-22888—Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of campaign-zone-zones.php. An attackEPSS 16.3%CVE-2022-4971MEDIUMSassy Social Share <= 3.3.3 - Reflected Cross-Site ScriptingEPSS 16.2%CVE-2025-2703MEDIUMThe built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in orEPSS 16.2%CVE-2021-24276—Contact Form by Supsystic < 1.7.15 - Reflected Cross-Site scripting (XSS)EPSS 16.0%