Weaknesses of type CWE-79

28,943 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-1825MEDIUMCross-site Scripting (XSS) - Reflected in collectiveaccess/providenceEPSS 0.6%CVE-2023-24879MEDIUMMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 0.6%CVE-2023-2058LOWEyouCms HTTP POST Request cross site scriptingEPSS 0.6%CVE-2025-1615MEDIUMFiberHome AN5506-01A ONU GPON NAT Submenu cross site scriptingEPSS 0.6%CVE-2022-43121MEDIUMA cross-site scripting (XSS) vulnerability in the CMS Field Add page of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitraryEPSS 0.6%CVE-2022-35137MEDIUMDGIOT Lightweight industrial IoT v4.5.4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.EPSS 0.6%CVE-2022-1730MEDIUMCross-site Scripting (XSS) - Stored in jgraph/drawioEPSS 0.6%CVE-2023-24921MEDIUMMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 0.6%CVE-2023-47114MEDIUMEthyca Fides HTML Injection Vulnerability in HTML-Formatted DSR PackagesEPSS 0.6%CVE-2023-21571MEDIUMMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 0.6%CVE-2023-6884MEDIUMPlugin for Google Reviews <= 3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcodeEPSS 0.6%CVE-2025-51464HIGHCross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious EPSS 0.6%CVE-2020-29025MEDIUMDOM-based Javascript injectionEPSS 0.6%CVE-2023-30394MEDIUMThe MoveIt framework 1.1.11 for ROS allows cross-site scripting (XSS) via the API authentication function. NOTE: this issue is disputed by tEPSS 0.6%CVE-2025-50481MEDIUMA cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitraryEPSS 0.6%CVE-2023-24919MEDIUMMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 0.6%CVE-2023-6896LOWSourceCodester Simple Image Stack Website cross site scriptingEPSS 0.6%CVE-2024-4726MEDIUMCampcodes Legal Case Management System clients cross site scriptingEPSS 0.6%CVE-2024-4521LOWCampcodes Complete Web-Based School Management System teacher_salary_details2.php cross site scriptingEPSS 0.6%CVE-2023-6466LOWThecosy IceCMS User Comment planet cross site scriptingEPSS 0.6%