Weaknesses of type CWE-79

28,832 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-43723MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.6%CVE-2024-4514LOWCampcodes Complete Web-Based School Management System timetable_insert_form.php cross site scriptingEPSS 0.6%CVE-2010-10002LOWSimpleSAMLphp simplesamlphp-module-openid OpenID consumer.php cross site scriptingEPSS 0.6%CVE-2022-2956LOWConsoleTVs Noxen users.php cross site scriptingEPSS 0.6%CVE-2022-24868HIGHCross site scripting via SVG file upload in GLPIEPSS 0.6%CVE-2006-10001LOWSubscribe to Comments Plugin subscribe-to-comments.php cross site scriptingEPSS 0.6%CVE-2025-58357CRITICAL5ire Chat Message XSS Vulnerability Enables Remote Code ExecutionEPSS 0.6%CVE-2023-48301LOWNextcloud Server HTML injection in search UI when selecting a circle with HTML in the display nameEPSS 0.6%CVE-2022-29880MEDIUMA vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate input in the configuration iEPSS 0.6%CVE-2024-40478MEDIUMA Stored Cross Site Scripting (XSS) vulnerability was found in "/admin/afeedback.php" in Kashipara Online Exam System v1.0, which allows remEPSS 0.6%CVE-2024-40473MEDIUMA Stored Cross Site Scripting (XSS) vulnerability was found in "manage_houses.php" in SourceCodester Best House Rental Management System v1.EPSS 0.6%CVE-2022-0395MEDIUMCross-site Scripting (XSS) - Stored in livehelperchat/livehelperchatEPSS 0.6%CVE-2022-43984HIGHBrowsershot 3.57.3 - Server Side XSS to LFR via HTMLEPSS 0.6%CVE-2021-24487—St Daily Tip <= 4.7 - CSRF to Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-2015MEDIUMCross-site Scripting (XSS) - Stored in jgraph/drawioEPSS 0.6%CVE-2020-9056LOWPeriscope BuySpeed version 14.5 is vulnerable to stored cross-site scriptingEPSS 0.6%CVE-2023-29836MEDIUMCross Site Scripting vulnerability found in Exelysis Unified Communication Solutions (EUCS) v.1.0 allows a remote attacker to execute arbitrEPSS 0.6%CVE-2023-0606CRITICALCross-site Scripting (XSS) - Reflected in ampache/ampacheEPSS 0.6%CVE-2020-36955MEDIUMGrav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site ScriptingEPSS 0.6%CVE-2022-41706HIGHBrowsershot 3.57.2 - Server Side XSS to LFR via URLEPSS 0.6%