Weaknesses of type CWE-79

28,826 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-24445—My Site Audit <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.7%CVE-2021-41161CRITICALXSS in csvimport in 3.0.0-beta versionsEPSS 0.7%CVE-2022-41334HIGHAn improper neutralization of input during web page generation [CWE-79] vulnerability in FortiOS versions 7.0.0 to 7.0.7 and 7.2.0 to 7.2.3 EPSS 0.7%CVE-2022-2684LOWSourceCodester Apartment Visitor Management System manage-apartment.php cross site scriptingEPSS 0.7%CVE-2024-27133HIGHInsufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset.EPSS 0.7%CVE-2022-2683LOWSourceCodester Simple Food Ordering System login.php cross site scriptingEPSS 0.7%CVE-2021-41162CRITICALCross-site Scripting in Combodo iTopEPSS 0.7%CVE-2021-4018MEDIUMCross-site Scripting (XSS) - Stored in snipe/snipe-itEPSS 0.7%CVE-2023-36828MEDIUMStatamic's Antlers sanitizer cannot effectively sanitize malicious SVGEPSS 0.7%CVE-2022-24864MEDIUMMalicious Javascript injection in OriginProtocol/origin-websiteEPSS 0.7%CVE-2023-5161MEDIUMModal Window <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.7%CVE-2023-21807MEDIUMMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 0.7%CVE-2022-0884—Profile Builder < 3.6.8 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2024-43720MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.7%CVE-2023-6769MEDIUMStored XSS vulnerability in Amazing Little PollEPSS 0.7%CVE-2024-28175CRITICALCross-site scripting on application summary component in argo-cdEPSS 0.7%CVE-2021-24963—LiteSpeed Cache < 4.4.4 - Admin+ Reflected Cross-Site ScriptingEPSS 0.7%CVE-2025-13418MEDIUMResponsive Pricing Table <= 5.1.12 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.7%CVE-2022-24432MEDIUMICSA-22-062-01 IPCOMM ipDIOEPSS 0.7%CVE-2021-25050—Remove Footer Credit < 1.0.11 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%