Weaknesses of type CWE-79

28,677 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-73417HIGHJupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)EPSS 0.7%CVE-2020-8031MEDIUMobs: Stored XSSEPSS 0.7%CVE-2022-4035HIGHAppointment Hour Booking <= 1.3.72 - Unauthenticated iFrame Injection via Appointment FormEPSS 0.7%CVE-2018-6590—CA API Developer Portal 4.x, prior to v4.2.5.3 and v4.2.7.1, has an unspecified reflected cross-site scripting vulnerability.EPSS 0.7%CVE-2021-39183HIGHUnsafe inline XSS OwncastEPSS 0.7%CVE-2021-24455—Tutor LMS < 1.9.2 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.7%CVE-2009-10001LOWjianlinwei cool-php-captcha example-form.php cross site scriptingEPSS 0.7%CVE-2017-7538LOWA cross-site scripting (XSS) flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an orEPSS 0.7%CVE-2021-24201—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Column ElementEPSS 0.7%CVE-2018-19942—Cross-site Scripting Vulnerability in File StationEPSS 0.7%CVE-2021-24204—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion WidgetEPSS 0.7%CVE-2021-41565MEDIUMTad TadTools - Reflected XSSEPSS 0.7%CVE-2021-24206—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box WidgetEPSS 0.7%CVE-2021-21577MEDIUMDell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. A remote attacker could potentially expEPSS 0.7%CVE-2024-0376MEDIUMPremium Addons for Elementor <= 4.10.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link WidgetEPSS 0.7%CVE-2022-1682CRITICALReflected Xss using url based payload in neorazorx/facturascriptsEPSS 0.7%CVE-2021-24202—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Heading WidgetEPSS 0.7%CVE-2021-21576MEDIUMDell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. A remote attacker could potentially expEPSS 0.7%CVE-2021-21581MEDIUMDell EMC iDRAC9 versions prior to 5.00.00.00 contain a cross-site scripting vulnerability. A remote attacker could potentially exploit this EPSS 0.7%CVE-2021-24203—Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Divider WidgetEPSS 0.7%