Weaknesses of type CWE-79

30,473 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2020-1936—Stored XSS in Apache AmbariEPSS 2.9%CVE-2024-35540HIGHA stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted EPSS 2.8%CVE-2022-42094MEDIUMBackdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.EPSS 2.8%CVE-2025-47851MEDIUMIn JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possibleEPSS 2.8%CVE-2024-46278HIGHTeedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.EPSS 2.8%CVE-2021-26544—Apache Livy (Incubating) is vulnerable to cross site scriptingEPSS 2.8%CVE-2021-3672—A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to oEPSS 2.8%CVE-2023-23078MEDIUMCross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in theEPSS 2.8%CVE-2023-23073MEDIUMCross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component.EPSS 2.8%CVE-2023-23077MEDIUMCross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment.EPSS 2.8%CVE-2020-9732CRITICALStored XSS in AEM Sites ComponentsEPSS 2.8%CVE-2022-25370—Unauth Stored XSS vulnerability in the Birt plugin of Apache OFBizEPSS 2.8%CVE-2020-25706MEDIUMA cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during teEPSS 2.8%CVE-2022-0994—Hummingbird < 3.3.2 - Admin+ Stored Cross-Site ScriptingEPSS 2.8%CVE-2023-42627CRITICALMultiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP EPSS 2.8%CVE-2023-42629CRITICALStored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 EPSS 2.8%CVE-2023-42628CRITICALStored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83EPSS 2.8%CVE-2023-28347CRITICALAn issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a proof-of-concept script that fEPSS 2.8%CVE-2021-24596—youForms for WordPress <= 1.0.5 - Authenticated Stored Cross-Site ScriptingEPSS 2.8%CVE-2022-2846MEDIUMCalendar Event Multi View < 1.4.07 - Unauthenticated Arbitrary Event Creation to Stored XSSEPSS 2.8%