Weaknesses of type CWE-79

28,979 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-40846MEDIUMIn Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576), a Stored Cross Site Scripting (XSS) vulnerability exists allowing an attacker to execEPSS 0.6%CVE-2023-0829HIGHCross-Site Scripting (XSS) vulnerability in PleskEPSS 0.6%CVE-2024-42898MEDIUMA cross-site scripting (XSS) vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted pEPSS 0.6%CVE-2024-2935MEDIUMSourceCodester Todo List in Kanban Board Add ToDo cross site scriptingEPSS 0.6%CVE-2022-1028—WordPress Security < 4.2.1 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-36872MEDIUMWordPress Popular Posts plugin <= 5.3.3 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2021-36870MEDIUMWordPress WP Google Maps plugin <= 8.1.12 - Multiple Authenticated Persistent XSS vulnerabilitiesEPSS 0.6%CVE-2023-25292MEDIUMReflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain seEPSS 0.6%CVE-2025-25427HIGHXSS in TP-Link TL-WR841N v14/v14.6/v14.8 Upnp pageEPSS 0.6%CVE-2022-38189MEDIUMThere is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript.EPSS 0.6%CVE-2022-23656MEDIUMCross-site scripting vulnerability in Zulip ServerEPSS 0.6%CVE-2025-29049MEDIUMCross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitraryEPSS 0.6%CVE-2022-40672MEDIUMWordPress CPO Shortcodes plugin <= 1.5.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2024-1700MEDIUMkeerti1924 PHP-MYSQL-User-Login-System signup.php cross site scriptingEPSS 0.6%CVE-2023-26123MEDIUMVersions of the package raysan5/raylib before 4.5.0 are vulnerable to Cross-site Scripting (XSS) such that the SetClipboardText API does notEPSS 0.6%CVE-2021-32855MEDIUMvditor vulnerable to Cross-site ScriptingEPSS 0.6%CVE-2021-41095MEDIUMXSS via blocked watched word in error messageEPSS 0.6%CVE-2021-32860MEDIUMiziModal vulnerable to Cross-site ScriptingEPSS 0.6%CVE-2026-0561MEDIUMShield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' ParameterEPSS 0.6%CVE-2022-40195MEDIUMWordPress PCA Predict plugin <= 1.0.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%