Weaknesses of type CWE-79

28,832 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-4677MEDIUMCampcodes Complete Web-Based School Management System my_student_exam_marks1.php cross site scriptingEPSS 0.6%CVE-2024-4715MEDIUMCampcodes Complete Web-Based School Management System update_grade.php cross site scriptingEPSS 0.6%CVE-2024-4676MEDIUMCampcodes Complete Web-Based School Management System range_grade_text.php cross site scriptingEPSS 0.6%CVE-2024-4716MEDIUMCampcodes Complete Web-Based School Management System update_exam.php cross site scriptingEPSS 0.6%CVE-2024-4718MEDIUMCampcodes Complete Web-Based School Management System delete_student_grade_subject.php cross site scriptingEPSS 0.6%CVE-2024-11243MEDIUMcode-projects Online Shop Store signup.php cross site scriptingEPSS 0.6%CVE-2023-6646LOWlinkding cross site scriptingEPSS 0.6%CVE-2023-5566MEDIUMSimple Shortcodes <= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2024-22417MEDIUMWhoogle Search Cross-site Scripting vulnerabilityEPSS 0.6%CVE-2024-4713MEDIUMCampcodes Complete Web-Based School Management System all_teacher.php cross site scriptingEPSS 0.6%CVE-2021-1507MEDIUMCisco SD-WAN vManage API Stored Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2024-4675MEDIUMCampcodes Complete Web-Based School Management System show_events.php cross site scriptingEPSS 0.6%CVE-2026-8445CRITICALjusthtml before 1.12.0 Sanitizer Bypass via MarkdownEPSS 0.6%CVE-2024-4674MEDIUMCampcodes Complete Web-Based School Management System show_friend_request.php cross site scriptingEPSS 0.6%CVE-2024-4722MEDIUMCampcodes Complete Web-Based School Management System index.php cross site scriptingEPSS 0.6%CVE-2024-4293LOWPHPGurukul Doctor Appointment Management System appointment-bwdates-reports-details.php cross site scriptingEPSS 0.6%CVE-2024-4719MEDIUMCampcodes Complete Web-Based School Management System delete_record.php cross site scriptingEPSS 0.6%CVE-2022-0539MEDIUMCross-site Scripting (XSS) - Stored in ptrofimov/beanstalk_consoleEPSS 0.6%CVE-2026-32890CRITICALAnchorr: Stored XSS in User Mapping dropdown allows unprivileged Discord users to exfiltrate all secrets via /api/configEPSS 0.6%CVE-2024-4673MEDIUMCampcodes Complete Web-Based School Management System show_student_grade_subject.php cross site scriptingEPSS 0.6%