Weaknesses of type CWE-79

30,473 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-27909MEDIUMXSS vulnerability on password reset pageEPSS 4.1%CVE-2025-27915MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in theEPSS 4.1%KEVCVE-2022-32772CRITICALA cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A sEPSS 4.0%CVE-2023-23408MEDIUMAzure Apache Ambari Spoofing VulnerabilityEPSS 4.0%CVE-2021-28957MEDIUMAn XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms argumeEPSS 4.0%CVE-2020-1106MEDIUMMicrosoft Office SharePoint XSS VulnerabilityEPSS 4.0%CVE-2023-30868HIGHWordPress CMS Tree Page View Plugin <= 1.6.7 is vulnerable to Cross Site Scripting (XSS)EPSS 4.0%CVE-2020-27783MEDIUMA XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused differeEPSS 4.0%CVE-2022-26842CRITICALA reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.6 and dev master comEPSS 4.0%CVE-2022-36664MEDIUMPassword Manager for IIS 2.0 has a cross-site scripting (XSS) vulnerability via the /isapi/PasswordManager.dll ResultURL parameter.EPSS 4.0%CVE-2019-1642MEDIUMCisco Firepower Management Center Cross-Site Scripting VulnerabilityEPSS 3.9%CVE-2023-24657MEDIUMphpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass parameter at /subnet-masks/poEPSS 3.9%CVE-2025-68614MEDIUMLibreNMS Alert Rule API Cross-Site Scripting VulnerabilityEPSS 3.9%CVE-2021-24335—Car Repair Services < 4.0 - Unauthenticated Reflected XSS & XFSEPSS 3.9%CVE-2022-0378HIGHCross-site Scripting (XSS) - Reflected in microweber/microweberEPSS 3.9%CVE-2022-0381MEDIUMEmbed Swagger <= 1.0.0 Reflected Cross-Site ScriptingEPSS 3.9%CVE-2025-20303MEDIUMMultiple vulnerabilities in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker EPSS 3.9%CVE-2022-0765—Loco Translate < 2.6.1 - Authenticated Stored Cross-Site ScriptingEPSS 3.8%CVE-2025-4388MEDIUMA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.QEPSS 3.8%CVE-2019-3911—Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an unauthenticated remoEPSS 3.8%