Weaknesses of type CWE-79

28,876 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-24751—GenerateBlocks < 1.4.0 - Contributor+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-29406MEDIUMWordPress Team Manager plugin <= 1.6.9 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.6%CVE-2021-24640—Gutenslider < 5.2.0 - Contributor+ Stored XSSEPSS 0.6%CVE-2023-38219HIGHValidate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrappingEPSS 0.6%CVE-2025-9003MEDIUMD-Link DIR-818LW DHCP Reserved Address bsc_lan.php cross site scriptingEPSS 0.6%CVE-2023-45137CRITICALXWiki Platform XSS with edit right in the create document form for existing pagesEPSS 0.6%CVE-2021-34359MEDIUMStored XSS Vulnerability in Proxy ServerEPSS 0.6%CVE-2024-53388HIGHA DOM Clobbering vulnerability in mavo v0.3.2 allows attackers to execute arbitrary code via supplying a crafted HTML element.EPSS 0.6%CVE-2012-10005LOWmanikandan170890 php-form-builder-class Textarea Textarea.php cross site scriptingEPSS 0.6%CVE-2024-53387HIGHA DOM Clobbering vulnerability in umeditor v1.2.3 allows attackers to execute arbitrary code via supplying a crafted HTML element.EPSS 0.6%CVE-2026-41200HIGHSTIG Manager has reflected XSS vulnerability in the Web AppEPSS 0.6%CVE-2020-3355MEDIUMCisco Data Center Network Manager Stored Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2022-39220MEDIUMXSS Vulnerabilities in WebClientEPSS 0.6%CVE-2019-15269MEDIUMCisco Firepower Management Center Multiple Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2020-3149MEDIUMCisco Identity Services Engine Stored Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2022-0906MEDIUMUnrestricted file upload leads to stored XSS in microweber/microweberEPSS 0.6%CVE-2020-3348MEDIUMCisco Data Center Network Manager Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2022-0703—GD Mylist <= 1.1.1 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-27416MEDIUMCross-site scripting in Hitachi ABB Power Grids Ellipse EAMEPSS 0.6%CVE-2022-0772MEDIUMCross-site Scripting (XSS) - Stored in librenms/librenmsEPSS 0.6%