Weaknesses of type CWE-79

28,487 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-27915MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in theEPSS 4.0%KEVCVE-2020-1106MEDIUMMicrosoft Office SharePoint XSS VulnerabilityEPSS 4.0%CVE-2020-27783MEDIUMA XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused differeEPSS 4.0%CVE-2022-32772CRITICALA cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A sEPSS 4.0%CVE-2019-1642MEDIUMCisco Firepower Management Center Cross-Site Scripting VulnerabilityEPSS 3.9%CVE-2023-24657MEDIUMphpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass parameter at /subnet-masks/poEPSS 3.9%CVE-2022-26842CRITICALA reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.6 and dev master comEPSS 3.9%CVE-2025-68614MEDIUMLibreNMS Alert Rule API Cross-Site Scripting VulnerabilityEPSS 3.9%CVE-2021-24335—Car Repair Services < 4.0 - Unauthenticated Reflected XSS & XFSEPSS 3.9%CVE-2022-0378HIGHCross-site Scripting (XSS) - Reflected in microweber/microweberEPSS 3.9%CVE-2022-0381MEDIUMEmbed Swagger <= 1.0.0 Reflected Cross-Site ScriptingEPSS 3.9%CVE-2022-0765—Loco Translate < 2.6.1 - Authenticated Stored Cross-Site ScriptingEPSS 3.8%CVE-2019-3911—Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an unauthenticated remoEPSS 3.8%CVE-2025-4388MEDIUMA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.QEPSS 3.8%CVE-2023-4119MEDIUMAcademy LMS courses cross site scriptingEPSS 3.8%CVE-2022-36664MEDIUMPassword Manager for IIS 2.0 has a cross-site scripting (XSS) vulnerability via the /isapi/PasswordManager.dll ResultURL parameter.EPSS 3.8%CVE-2021-24389—FoodBakery < 2.2 - Reflected Cross-Site Scripting (XSS)EPSS 3.8%CVE-2020-25627—The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk. This affects versions 3.9 to 3.9.1. Fixed inEPSS 3.7%CVE-2025-51991HIGHXWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within theEPSS 3.7%CVE-2022-0776MEDIUMCross-site Scripting (XSS) - DOM in hakimel/reveal.jsEPSS 3.7%