Weaknesses of type CWE-79

28,459 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-0594HIGHGrafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability EPSS 9.2%CVE-2023-4174LOWmooSocial mooStore cross site scriptingEPSS 9.1%CVE-2023-30256MEDIUMCross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back andEPSS 9.1%CVE-2021-41183MEDIUMXSS in `*Text` options of the Datepicker widgetEPSS 8.5%CVE-2024-54779MEDIUMNetgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.wiEPSS 8.5%CVE-2023-4113MEDIUMPHP Jabbers Service Booking Script index.php cross site scriptingEPSS 8.4%CVE-2023-4116MEDIUMPHP Jabbers Taxi Booking index.php cross site scriptingEPSS 8.4%CVE-2023-4115MEDIUMPHP Jabbers Cleaning Business index.php cross site scriptingEPSS 8.4%CVE-2023-4112MEDIUMPHP Jabbers Shuttle Booking Software index.php cross site scriptingEPSS 8.4%CVE-2021-23282MEDIUMStored Cross-site Scripting reported in Intelligent Power Manager v1EPSS 8.3%CVE-2023-4114MEDIUMPHP Jabbers Night Club Booking Software index.php cross site scriptingEPSS 8.3%CVE-2024-31204MEDIUMmailcow Cross-site Scripting Vulnerability via Exception HandlerEPSS 8.2%CVE-2022-0422—White Label MS < 2.2.9 - Reflected Cross-Site ScriptingEPSS 8.1%CVE-2023-30212MEDIUMOURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.EPSS 8.1%CVE-2024-31839MEDIUMCross Site Scripting vulnerability in tiagorlampert CHAOS v.5.0.1 allows a remote attacker to escalate privileges via the sendCommandHandlerEPSS 8.0%CVE-2025-1392MEDIUMD-Link DIR-816 index.html cross site scriptingEPSS 8.0%CVE-2022-23808MEDIUMAn issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can alEPSS 7.9%CVE-2021-29484MEDIUMDOM XSS in Theme PreviewEPSS 7.9%CVE-2021-21803CRITICALThis vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially craftEPSS 7.9%CVE-2016-2279MEDIUMCross-site scripting (XSS) vulnerability in the web server in Rockwell Automation Allen-Bradley CompactLogix 1769-L* before 28.011+ allows rEPSS 7.6%