Weaknesses of type CWE-79

28,952 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-1605MEDIUMCisco Identity Services Engine Stored Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2023-1715CRITICALBitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2)EPSS 0.6%CVE-2024-24594CRITICALA cross-site scripting (XSS) vulnerability in all versions of the web server component of Allegro AI’s ClearML platform allows a remote attaEPSS 0.6%CVE-2024-3675MEDIUMRoyal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flip Carousel, Flip Box, Post Grid, and Taxonomy List Widget AttributesEPSS 0.6%CVE-2021-4038MEDIUMNSM vulnerable to XSSEPSS 0.6%CVE-2023-1565LOWFeiFeiCMS Extension Tool slide_add.html cross site scriptingEPSS 0.6%CVE-2023-3060LOWcode-projects Agro-School Management System btn_functions.php doAddQuestion cross site scriptingEPSS 0.6%CVE-2022-26673MEDIUMASUS RT-AX88U - Stored XSSEPSS 0.6%CVE-2021-1603MEDIUMCisco Identity Services Engine Stored Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2024-9944MEDIUMWooCommerce <= 9.0.2 - Unauthenticated HTML InjectionEPSS 0.6%CVE-2023-3708MEDIUMMultiple DeoThemes Themes <= (Various Versions) - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2015-10107LOWSimplr Registration Form Plus+ Plugin cross site scriptingEPSS 0.6%CVE-2015-10119LOWView All Posts Page Plugin view-all-posts-pages.php action_admin_notices_activation cross site scriptingEPSS 0.6%CVE-2013-10020LOWMMDeveloper A Forms Plugin a-forms.php cross site scriptingEPSS 0.6%CVE-2024-32887MEDIUMReflected XSS in sidekiqEPSS 0.6%CVE-2021-36857MEDIUMWordPress Testimonial Builder plugin <= 1.6.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2021-1604MEDIUMCisco Identity Services Engine Stored Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2025-52558HIGHChangeDetection.io XSS in watch overviewEPSS 0.6%CVE-2023-35796HIGHA vulnerability has been identified in SINEMA Server V14 (All versions). The affected application improperly sanitizes certain SNMP configurEPSS 0.6%CVE-2022-39325MEDIUMCross-site scripting vulnerability in BaserCMSEPSS 0.6%