Weaknesses of type CWE-79

30,470 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-4174LOWmooSocial mooStore cross site scriptingEPSS 9.1%CVE-2023-30256MEDIUMCross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back andEPSS 9.1%CVE-2025-1392MEDIUMD-Link DIR-816 index.html cross site scriptingEPSS 8.7%CVE-2021-41183MEDIUMXSS in `*Text` options of the Datepicker widgetEPSS 8.5%CVE-2024-54779MEDIUMNetgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.wiEPSS 8.5%CVE-2023-4115MEDIUMPHP Jabbers Cleaning Business index.php cross site scriptingEPSS 8.4%CVE-2023-4112MEDIUMPHP Jabbers Shuttle Booking Software index.php cross site scriptingEPSS 8.4%CVE-2023-4116MEDIUMPHP Jabbers Taxi Booking index.php cross site scriptingEPSS 8.4%CVE-2023-4113MEDIUMPHP Jabbers Service Booking Script index.php cross site scriptingEPSS 8.4%CVE-2021-23282MEDIUMStored Cross-site Scripting reported in Intelligent Power Manager v1EPSS 8.3%CVE-2023-4114MEDIUMPHP Jabbers Night Club Booking Software index.php cross site scriptingEPSS 8.3%CVE-2022-3766HIGHCross-site Scripting (XSS) - Reflected in thorsten/phpmyfaqEPSS 8.3%CVE-2026-8438HIGHAll-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request PathEPSS 8.3%CVE-2024-31204MEDIUMmailcow Cross-site Scripting Vulnerability via Exception HandlerEPSS 8.2%CVE-2023-30212MEDIUMOURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.EPSS 8.1%CVE-2024-31839MEDIUMCross Site Scripting vulnerability in tiagorlampert CHAOS v.5.0.1 allows a remote attacker to escalate privileges via the sendCommandHandlerEPSS 8.1%CVE-2022-0422—White Label MS < 2.2.9 - Reflected Cross-Site ScriptingEPSS 8.1%CVE-2022-23808MEDIUMAn issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can alEPSS 7.9%CVE-2021-29484MEDIUMDOM XSS in Theme PreviewEPSS 7.9%CVE-2021-21803CRITICALThis vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially craftEPSS 7.9%