Weaknesses of type CWE-79

28,462 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2014-3146MEDIUMIncomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scriptinEPSS 6.3%CVE-2022-39195MEDIUMA cross-site scripting (XSS) vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary JavaScript or HTML vEPSS 6.3%CVE-2025-54353MEDIUMAn Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet ForEPSS 6.3%CVE-2021-24237—Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS)EPSS 6.3%CVE-2022-3766HIGHCross-site Scripting (XSS) - Reflected in thorsten/phpmyfaqEPSS 6.1%CVE-2023-0527LOWPHPGurukul Online Security Guards Hiring System search-request.php cross site scriptingEPSS 6.1%CVE-2023-3843LOWmooSocial mooDating URL question cross site scriptingEPSS 6.0%CVE-2023-3844LOWmooSocial mooDating URL friends cross site scriptingEPSS 6.0%CVE-2023-3847LOWmooSocial mooDating URL users cross site scriptingEPSS 6.0%CVE-2023-3848LOWmooSocial mooDating URL view cross site scriptingEPSS 6.0%CVE-2023-3849LOWmooSocial mooDating URL find-a-match cross site scriptingEPSS 6.0%CVE-2023-3845LOWmooSocial mooDating URL ajax_invite cross site scriptingEPSS 6.0%CVE-2023-3846LOWmooSocial mooDating URL pages cross site scriptingEPSS 6.0%CVE-2025-58747LOWDify MCP OAuth Flow Vulnerable to XSSEPSS 5.7%CVE-2022-0448—CP Blocks < 1.0.15 - Admin+ Stored Cross-Site ScriptingEPSS 5.7%CVE-2020-13959—Velocity Tools XSS VulnerabilityEPSS 5.7%CVE-2021-24245—Stop Spammers < 2021.9 - Reflected Cross-Site Scripting (XSS)EPSS 5.7%CVE-2021-21030HIGHMagento Commerce Stored Cross-site Scripting Could Lead To Arbitrary Javascript ExecutionEPSS 5.6%CVE-2021-24299—ReDi Restaurant Reservations < 21.0426 - Unauthenticated Stored Cross-Site Scripting (XSS)EPSS 5.5%CVE-2024-5420HIGHStored Cross-Site Scripting in SEH Computertechnik utnserver ProEPSS 5.5%