Weaknesses of type CWE-79

28,839 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-47523HIGHLibreNMS has Stored Cross-site Scripting vulnerability in "Alert Transports" featureEPSS 0.6%CVE-2023-3726MEDIUMOCSInventory-ocsreports 2.12.0 - Stored cross-site ScriptingEPSS 0.6%CVE-2022-45382MEDIUMJenkins Naginator Plugin 1.18.1 and earlier does not escape display names of source builds in builds that were triggered via Retry action, rEPSS 0.6%CVE-2022-2516MEDIUMVisual Composer Website Builder <= 45.0 - Authenticated Stored Cross-Site Scripting via 'Title'EPSS 0.6%CVE-2023-49289MEDIUMCross-site Scripting in Ajax.NET ProfessionalEPSS 0.6%CVE-2025-32430MEDIUMXWiki Platform contains Reflected XSS vulnerability in two templatesEPSS 0.6%CVE-2022-48327MEDIUMMultiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parametEPSS 0.6%CVE-2020-3185MEDIUMCisco TelePresence Management Suite Stored Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2023-51800MEDIUMCross Site Scripting (XSS) vulnerability in School Fees Management System v.1.0 allows a remote attacker to execute arbitrary code via a craEPSS 0.6%CVE-2020-3113MEDIUMCisco Data Center Network Manager Stored Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2022-48324MEDIUMMultiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parametEPSS 0.6%CVE-2021-24168—Easy Contact Form Pro < 1.1.1.9 - Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2026-40126MEDIUMDOM-based Cross-Site Scripting in OutSystems Service CenterEPSS 0.6%CVE-2024-8866MEDIUMAutoCMS robot.php cross site scriptingEPSS 0.6%CVE-2023-45796HIGHXSS vulnerability in Pilz PASvisu and PMI v8xxEPSS 0.6%CVE-2020-15245MEDIUMEmail verification bypass in SyliusEPSS 0.6%CVE-2020-8291—A link preview rendering issue in Rocket.Chat versions before 3.9 could lead to potential XSS attacks.EPSS 0.6%CVE-2021-24425—myStickymenu < 2.5.2 - Authenticated Stored XSSEPSS 0.6%CVE-2021-29434MEDIUMImproper validation of URLs ('Cross-site Scripting') in Wagtail rich text fieldsEPSS 0.6%CVE-2021-24258—ElementsKit and ElementsKit Pro < 2.2.0 - Contributor+ Stored XSSEPSS 0.6%