Weaknesses of type CWE-79

28,777 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-38724MEDIUMSilverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow XSEPSS 0.7%CVE-2022-2655—Classified Listing Pro < 2.0.20 - Reflected Cross-Site ScriptingEPSS 0.7%CVE-2021-32851MEDIUMjQuery MiniColors vulnerable to Cross-site ScriptingEPSS 0.7%CVE-2026-33066MEDIUMSiYuan has Stored XSS to RCE via Unsanitized Bazaar README RenderingEPSS 0.7%CVE-2025-24981CRITICALParsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdcEPSS 0.7%CVE-2023-3009HIGHCross-site Scripting (XSS) - Stored in nilsteampassnet/teampassEPSS 0.7%CVE-2021-24702—LearnPress < 4.1.3.1 - Multiple Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2024-0266MEDIUMProject Worlds Online Lawyer Management System User Registration cross site scriptingEPSS 0.7%CVE-2024-39203MEDIUMA cross-site scripting (XSS) vulnerability in the Backend Theme Management module of Z-BlogPHP v1.7.3 allows attackers to execute arbitrary EPSS 0.7%CVE-2022-3231MEDIUMCross-site Scripting (XSS) - Stored in librenms/librenmsEPSS 0.7%CVE-2020-5294MEDIUMReflected XSS with social networks fieldsEPSS 0.7%CVE-2021-25115—WP Photo Album Plus < 8.0.10 - Stored Cross-Site Scripting (XSS)EPSS 0.7%CVE-2023-0607HIGHCross-site Scripting (XSS) - Stored in projectsend/projectsendEPSS 0.7%CVE-2021-37518MEDIUMUniversal Cross Site Scripting (UXSS) vulnerability in Vimium Extension 1.66 and earlier allows remote attackers to run arbitrary code via oEPSS 0.7%CVE-2017-20159LOWrf Keynote rumble.rb cross site scriptingEPSS 0.7%CVE-2026-81887MEDIUMLivewire DOM-based cross-site scripting during client-side state handlingEPSS 0.7%CVE-2022-23638MEDIUMCross-site Scripting in svg-sanitizerEPSS 0.7%CVE-2023-23942MEDIUMSelf reflected HTML injection in Desktop clientEPSS 0.7%CVE-2021-24494—WP Offload SES Lite < 1.4.5 - Stored Cross-Site Scripting (XSS)EPSS 0.7%CVE-2022-2646LOWSourceCodester Online Admission System index.php cross site scriptingEPSS 0.7%