Weaknesses of type CWE-79

30,473 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-0087HIGHCross-site Scripting (XSS) - Reflected in keystonejs/keystoneEPSS 2.8%CVE-2023-53931MEDIUMRevive Adserver 5.4.1 Cross-Site Scripting via Banner Advanced SettingsEPSS 2.7%CVE-2023-1892HIGHCross-site Scripting (XSS) - Reflected in sidekiq/sidekiqEPSS 2.7%CVE-2021-22948—Vulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the cryptographically insecure uniqid() PHP function. UnEPSS 2.7%CVE-2021-42551MEDIUMReflected XSS in NetBiblio WebOPAC search functionalityEPSS 2.7%CVE-2025-44136CRITICALMapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message withoutEPSS 2.7%CVE-2022-30519MEDIUMXSS in signing form in Reprise Software RLM License Administration v14.2BL4 allows remote attacker to inject arbitrary code via password fieEPSS 2.7%CVE-2023-37269LOWWinter CMS vulnerable to stored XSS through privileged upload of SVG fileEPSS 2.7%CVE-2023-0902LOWSourceCodester Simple Food Ordering System process_order.php cross site scriptingEPSS 2.7%CVE-2022-31160MEDIUMjQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text labelEPSS 2.7%CVE-2023-26692MEDIUMZCBS Zijper Collectie Beheer Systeem (ZCBS), Zijper Publication Management System (ZPBS), and Zijper Image Bank Management System (ZBBS) 4.1EPSS 2.7%CVE-2021-32797HIGHJupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>EPSS 2.7%CVE-2018-25080LOWMobileDetect Example session_example.php initLayoutType cross site scriptingEPSS 2.7%CVE-2021-43818HIGHHTML Cleaner allows crafted and SVG embedded scripts to pass throughEPSS 2.6%CVE-2022-2174MEDIUMCross-site Scripting (XSS) - Reflected in microweber/microweberEPSS 2.6%CVE-2021-34620HIGHCSRF in WP Fluent Forms < 3.6.67 allows stored XSS and Privilege EscalationEPSS 2.6%CVE-2022-47877CRITICALA Stored cross-site scripting vulnerability in Jedox 2020.2.5 allows remote, authenticated users to inject arbitrary web script or HTML in tEPSS 2.6%CVE-2023-23286MEDIUMCross Site Scripting (XSS) vulnerability in Provide server 14.4 allows attackers to execute arbitrary code through the server-log via usernaEPSS 2.6%CVE-2023-23075MEDIUMCross Site Scripting (XSS) vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation.EPSS 2.6%CVE-2018-0403—Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenEPSS 2.6%