Weaknesses of type CWE-79

28,487 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-24899HIGHCross site scripting via canonical tagEPSS 4.5%CVE-2023-31703CRITICALCross Site Scripting (XSS) in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker tEPSS 4.5%CVE-2021-24329—WP Super Cache < 1.7.3 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 4.5%CVE-2022-32770CRITICALA cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A sEPSS 4.4%CVE-2022-0750MEDIUMPhotoswipe Masonry Gallery <= 1.2.14 Stored Cross-Site ScriptingEPSS 4.4%CVE-2022-0210MEDIUMRandom Banner <= 4.1.4 Admin+ Stored Cross-Site ScriptingEPSS 4.4%CVE-2026-48320HIGHColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 4.3%CVE-2022-32771CRITICALA cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A sEPSS 4.2%CVE-2026-27822CRITICALRust has Critical Stored XSS in Preview Modal, leading to Administrative Account TakeoverEPSS 4.2%CVE-2025-68165MEDIUMIn JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setupEPSS 4.2%CVE-2025-52367MEDIUMCross Site Scripting vulnerability in PivotX CMS v.3.0.0 RC 3 allows a remote attacker to execute arbitrary code via the subtitle field.EPSS 4.1%CVE-2022-24384HIGHReflective XSS on SmarterTrack v100.0.8019.14010EPSS 4.1%CVE-2021-24581—Blue Admin <= 21.06.01 - CSRF to Stored Cross-Site Scripting (XSS)EPSS 4.1%CVE-2022-32533CRITICALApache Portals Jetspeed XSS, CSRF, SSRF, and XXE issuesEPSS 4.1%CVE-2025-8100MEDIUMElement Pack Elementor Addons and Templates <= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker ContentEPSS 4.1%CVE-2021-27909MEDIUMXSS vulnerability on password reset pageEPSS 4.1%CVE-2023-23408MEDIUMAzure Apache Ambari Spoofing VulnerabilityEPSS 4.0%CVE-2022-39285HIGHStored Cross-Site Scripting Vulnerability In File Parameter in zoneminderEPSS 4.0%CVE-2021-28957MEDIUMAn XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms argumeEPSS 4.0%CVE-2023-30868HIGHWordPress CMS Tree Page View Plugin <= 1.6.7 is vulnerable to Cross Site Scripting (XSS)EPSS 4.0%