Weaknesses of type CWE-79

28,947 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2017-20153LOWaerouk imageserve cross site scriptingEPSS 0.6%CVE-2022-1093—WP Meta SEO < 4.4.7 - Admin+ Stored Cross-Site Scripting via breadcrumbsEPSS 0.6%CVE-2023-2381LOWNetgear SRX5308 Web Management Interface cross site scriptingEPSS 0.6%CVE-2021-25005—SEUR Oficial < 1.7.0 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-28639MEDIUMGLPI vulnerable to reflected Cross-site Scripting in search pagesEPSS 0.6%CVE-2024-0591MEDIUMwpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 3.4.2.2 - Reflected Cross-Site Scripting.EPSS 0.6%CVE-2023-6303LOWCSZCMS Site Settings Page cross site scriptingEPSS 0.6%CVE-2025-26791MEDIUMDOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).EPSS 0.6%CVE-2023-2386LOWNetgear SRX5308 Web Management Interface cross site scriptingEPSS 0.6%CVE-2023-3158HIGHMail Control <= 0.2.8 - Unauthenticated Stored Cross-Site Scripting via Email SubjectEPSS 0.6%CVE-2014-3650—Multiple persistent cross-site scripting (XSS) flaws were found in the way Aerogear handled certain user-supplied content. A remote attackerEPSS 0.6%CVE-2021-24821—Cost Calculator < 1.6 - Contributor+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-24817—Ultimate NoFollow <= 1.4.8 - Contributor+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-1851LOWSourceCodester Online Payroll System employee_add.php cross site scriptingEPSS 0.6%CVE-2023-2055LOWCampcodes Advanced Online Voting System config_save.php cross site scriptingEPSS 0.6%CVE-2023-3887LOWCampcodes Beauty Salon Management System search-appointment.php cross site scriptingEPSS 0.6%CVE-2021-42360HIGHStarter Templates — Elementor, Gutenberg & Beaver Builder Templates <= 2.7.0 Authenticated Block Import to Stored XSSEPSS 0.6%CVE-2022-22812—A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a web sEPSS 0.6%CVE-2023-1746LOWDreamer CMS File Upload cross site scriptingEPSS 0.6%CVE-2021-24828—Mortgage Calculator / Loan Calculator < 1.5.17 - Contributor+ Stored Cross-Site ScriptingEPSS 0.6%