Weaknesses of type CWE-79

28,942 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-28367MEDIUMCross-site scripting vulnerability in CTA post function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authenticated aEPSS 0.6%CVE-2023-27923MEDIUMCross-site scripting vulnerability in Tag edit function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a reEPSS 0.6%CVE-2023-2220LOWDream Technology mica Form Object cross site scriptingEPSS 0.6%CVE-2023-4145MEDIUMCross-site Scripting (XSS) - Stored in pimcore/customer-data-frameworkEPSS 0.6%CVE-2022-20802MEDIUMCisco Enterprise Chat and Email Stored Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2022-2371—YaySMTP < 2.2.1 - Subscriber+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-6313LOWSourceCodester URL Shortener Long URL cross site scriptingEPSS 0.6%CVE-2025-28074MEDIUMphpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php. The vulnerability is exploitEPSS 0.6%CVE-2026-28223MEDIUMWagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interfaceEPSS 0.6%CVE-2017-7438MEDIUMDOM cross site scripting attack against NetIQ Privileged Account ManagerEPSS 0.6%CVE-2024-52793MEDIUMXSS vulnerability in serveDir API of @std/http/file-server on POSIX systemsEPSS 0.6%CVE-2023-3143LOWSourceCodester Online Discussion Forum Site manage_post.php cross site scriptingEPSS 0.6%CVE-2026-28222MEDIUMWagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributesEPSS 0.6%CVE-2022-2391—Inspiro Pro < 7.2.3 - Contributor+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2025-28073MEDIUMphpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitraryEPSS 0.6%CVE-2026-65767HIGHMicrosoft Teams for Android Spoofing VulnerabilityEPSS 0.6%CVE-2022-2299—Allow SVG Files <= 1.1 - Author+ Stored Cross Site Scripting via SVGEPSS 0.6%CVE-2023-2516MEDIUMCross-site Scripting (XSS) - Stored in nilsteampassnet/teampassEPSS 0.6%CVE-2023-1374MEDIUMSolidres <= 0.9.4 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-2015MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions starting from 15.8 before 15.10.8, all versions starting from 15.11 befoEPSS 0.6%