Weaknesses of type CWE-79

28,949 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-1840LOWHome Clean Services Management System cross site scriptingEPSS 0.6%CVE-2024-48589MEDIUMCross Site Scripting vulnerability in Gilnei Moraes phpABook v.0.9 allows a remote attacker to execute arbitrary code via the rol parameter EPSS 0.6%CVE-2022-42110MEDIUMA Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fixEPSS 0.6%CVE-2022-4841HIGHCross-site Scripting (XSS) - Stored in usememos/memosEPSS 0.6%CVE-2024-13630MEDIUMNews List <= 1.0 - Reflected XSSEPSS 0.6%CVE-2023-0786HIGHCross-site Scripting (XSS) - Generic in thorsten/phpmyfaqEPSS 0.6%CVE-2024-40333HIGHidccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/softBak_deal.php?mudi=del&dataID=2EPSS 0.6%CVE-2025-4461MEDIUMTOTOLINK N150RT Virtual Server Page cross site scriptingEPSS 0.6%CVE-2024-12737MEDIUMWP BASE Booking of Appointments, Services and Events < 5.0.0 - Reflected XSSEPSS 0.6%CVE-2022-37407MEDIUMWordPress Gallery PhotoBlocks plugin <= 1.2.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.6%CVE-2025-4470MEDIUMSourceCodester Online Student Clearance System add-student.php cross site scriptingEPSS 0.6%CVE-2023-45819MEDIUMCross-site Scripting vulnerability in TinyMCE notificationManager.open APIEPSS 0.6%CVE-2026-33113MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 0.6%CVE-2025-4469MEDIUMSourceCodester Online Student Clearance System add-admin.php cross site scriptingEPSS 0.6%CVE-2023-1754MEDIUMImproper Neutralization of Input During Web Page Generation in thorsten/phpmyfaqEPSS 0.6%CVE-2022-1180MEDIUMReflected Cross Site Scripting in openemr/openemrEPSS 0.6%CVE-2023-1131LOWSourceCodester Computer Parts Sales and Inventory System customer.php cross site scriptingEPSS 0.6%CVE-2022-1991LOWFast Food Ordering System Master List Master.php cross site scriptingEPSS 0.6%CVE-2024-40036HIGHidccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userGroup_deal.php?mudi=add&nohrefStr=clEPSS 0.6%CVE-2026-27176MEDIUMMajorDoMo Reflected Cross-Site Scripting in command.phpEPSS 0.6%