Weaknesses of type CWE-79

28,833 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-2671LOWSourceCodester Lost and Found Information System Contact Form cross site scriptingEPSS 0.6%CVE-2019-15968MEDIUMCisco Unified Communications Domain Manager Persistent Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2022-22117MEDIUMDirectus - Stored Cross-Site Scripting (XSS) in Profile Avatar ImageEPSS 0.6%CVE-2019-16008MEDIUMCisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2020-3233MEDIUMCisco IOx Application Framework Local Manager Stored Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2023-35157HIGHXWiki Platform vulnerable to reflected cross-site scripting via delattachment actionEPSS 0.6%CVE-2022-39172MEDIUMA stored XSS in the process overview (bersicht zugewiesener Vorgaenge) in mbsupport openVIVA c2 20220101 allows a remote, authenticated, lowEPSS 0.6%CVE-2020-3320MEDIUMCisco Firepower Management Center Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2021-24421—WP JobSearch < 1.7.4 - Authenticated Stored XSSEPSS 0.6%CVE-2019-12702MEDIUMCisco SPA100 Series Analog Telephone Adapters Reflected Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2026-66418CRITICALOpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username FieldEPSS 0.6%CVE-2015-10078LOWatwellpub Resend Welcome Email Plugin resend-welcome-email.php send_welcome_email_url cross site scriptingEPSS 0.6%CVE-2022-22116MEDIUMDirectus - Stored Cross-Site Scripting (XSS) via SVG File UploadEPSS 0.6%CVE-2026-66421HIGHOpenClaw Dashboard Stored XSS via lastMessage Session FieldEPSS 0.6%CVE-2020-3157MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2019-12637MEDIUMCisco Identity Services Engine Multiple Stored Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2016-15027LOWmeta4creations Post Duplicator Plugin notices.php mtphr_post_duplicator_notice cross site scriptingEPSS 0.6%CVE-2019-12638MEDIUMCisco Identity Services Engine Stored Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2024-31857MEDIUMForminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain uEPSS 0.6%CVE-2022-43556MEDIUMConcrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dasEPSS 0.6%