Weaknesses of type CWE-79

28,667 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-40785MEDIUMThis issue was addressed with improved checks. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, mEPSS 0.8%CVE-2024-40511HIGHCross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMServerAdmiEPSS 0.8%CVE-2025-34032MEDIUMMoodle LMS Jmol Plugin Cross-site Scripting (XSS)EPSS 0.8%CVE-2020-7015—Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. An attacker who is able to edit or create a TSVEPSS 0.8%CVE-2022-3223MEDIUMCross-site Scripting (XSS) - Stored in jgraph/drawioEPSS 0.8%CVE-2021-4358HIGHWP DSGVO Tools (GDPR) <= 3.1.23 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.8%CVE-2022-23552HIGHGrafana stored XSS in FileUploader component EPSS 0.8%CVE-2024-44779HIGHA reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to exeEPSS 0.8%CVE-2023-47777MEDIUMWordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2019-3747HIGHDell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability. A remote malicious EPSS 0.8%CVE-2025-61623MEDIUMApache OFBiz: Reflected Cross-site ScriptingEPSS 0.8%CVE-2023-28836MEDIUMWagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin viewsEPSS 0.8%CVE-2017-9276MEDIUMXSS Vulnerability in iManagerEPSS 0.8%CVE-2020-10776—A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allEPSS 0.8%CVE-2022-46165MEDIUMCross-site Scripting (XSS) in Web GUI in syncthingEPSS 0.8%CVE-2026-0594MEDIUMList Site Contributors <= 1.1.8 - Reflected Cross-Site Scripting via alphaEPSS 0.8%CVE-2022-1445CRITICALStored Cross Site Scripting vulnerability in the checked_out_to parameter in snipe/snipe-itEPSS 0.8%CVE-2024-11381MEDIUMControl horas <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.8%CVE-2020-29029HIGHXSS issue due to insufficient sanitization of input fieldEPSS 0.8%CVE-2022-0889HIGHNinja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site ScriptingEPSS 0.8%