Weaknesses of type CWE-79

30,470 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-54353MEDIUMAn Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet ForEPSS 6.3%CVE-2021-24237—Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)EPSS 6.3%CVE-2012-0767MEDIUMCross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, aEPSS 6.2%KEVCVE-2023-0527LOWPHPGurukul Online Security Guards Hiring System search-request.php cross site scriptingEPSS 6.1%CVE-2025-58747LOWDify MCP OAuth Flow Vulnerable to XSSEPSS 6.0%CVE-2022-2383—Feed Them Social < 3.0.1 - Reflected Cross-Site ScriptingEPSS 6.0%CVE-2023-3843LOWmooSocial mooDating URL question cross site scriptingEPSS 6.0%CVE-2023-3849LOWmooSocial mooDating URL find-a-match cross site scriptingEPSS 6.0%CVE-2023-3847LOWmooSocial mooDating URL users cross site scriptingEPSS 6.0%CVE-2023-3845LOWmooSocial mooDating URL ajax_invite cross site scriptingEPSS 6.0%CVE-2023-3844LOWmooSocial mooDating URL friends cross site scriptingEPSS 6.0%CVE-2023-3846LOWmooSocial mooDating URL pages cross site scriptingEPSS 6.0%CVE-2023-3848LOWmooSocial mooDating URL view cross site scriptingEPSS 6.0%CVE-2021-21030HIGHMagento Commerce Stored Cross-site Scripting Could Lead To Arbitrary Javascript ExecutionEPSS 5.9%CVE-2025-8100MEDIUMElement Pack Elementor Addons and Templates <= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker ContentEPSS 5.8%CVE-2022-0448—CP Blocks < 1.0.15 - Admin+ Stored Cross-Site ScriptingEPSS 5.7%CVE-2021-24245—Stop Spammers < 2021.9 - Reflected Cross-Site Scripting (XSS)EPSS 5.7%CVE-2020-13959—Velocity Tools XSS VulnerabilityEPSS 5.7%CVE-2025-54252MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 5.6%CVE-2021-24299—ReDi Restaurant Reservations < 21.0426 - Unauthenticated Stored Cross-Site Scripting (XSS)EPSS 5.5%