Weaknesses of type CWE-79

28,456 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2010-3243MEDIUMCross-site scripting (XSS) vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in MicrosoEPSS 15.7%CVE-2025-30292MEDIUMColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 15.5%CVE-2023-0507HIGHGrafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability EPSS 15.5%CVE-2024-47002HIGHA html code injection vulnerability exists in the vlan management part of Observium CE 24.4.13528. A specially crafted HTTP request can leadEPSS 15.4%CVE-2022-0437MEDIUMCross-site Scripting (XSS) - DOM in karma-runner/karmaEPSS 15.1%CVE-2025-34175MEDIUMNetgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site ScriptingEPSS 14.8%CVE-2024-45741MEDIUMPersistent Cross-Site Scripting (XSS) via props.conf on Splunk EnterpriseEPSS 14.8%CVE-2024-31444MEDIUMCacti XSS vulnerability in lib/html.php by reading dirty data stored in databaseEPSS 14.7%CVE-2021-24291—Photo Gallery < 1.5.69 - Multiple Reflected Cross-Site Scripting (XSS)EPSS 14.4%CVE-2025-32794HIGHOpenEMR Stored XSS via Patient Name Field in Procedure OrdersEPSS 14.4%CVE-2021-21800CRITICALCross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user vEPSS 14.1%CVE-2025-43860HIGHOpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient DemographicsEPSS 14.1%CVE-2025-50538HIGHFlowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.EPSS 14.0%CVE-2011-1252MEDIUMCross-site scripting (XSS) vulnerability in the SafeHTML function in the toStaticHTML API in Microsoft Internet Explorer 7 and 8, Office ShaEPSS 14.0%CVE-2021-24286—Redirect 404 to Parent < 1.3.1 - Reflected Cross-Site Scripting (XSS)EPSS 13.9%CVE-2019-3810MEDIUMA flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ EPSS 13.9%CVE-2025-52378MEDIUMCross-Site Scripting (XSS) vulnerability in Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below allowing attackers to inject JaEPSS 13.9%CVE-2024-5410HIGHStored Cross-Site ScriptingEPSS 13.7%CVE-2022-0595—Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSSEPSS 13.6%CVE-2007-4040HIGHArgument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers EPSS 13.5%