Weaknesses of type CWE-79

28,988 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-31113MEDIUMCross-Site Scripting in Canarytoken historyEPSS 0.6%CVE-2024-4524LOWCampcodes Complete Web-Based School Management System student_payment_invoice.php cross site scriptingEPSS 0.6%CVE-2022-25847MEDIUMAll versions of the package serve-lite are vulnerable to Cross-site Scripting (XSS) because when it detects a request to a directory, it renEPSS 0.6%CVE-2020-11074MEDIUMStored XSS in PrestaShopEPSS 0.6%CVE-2025-0557MEDIUMHyland Alfresco Community Edition URL s cross site scriptingEPSS 0.6%CVE-2022-0955MEDIUMCross-site Scripting (XSS) - Stored in pimcore/data-hubEPSS 0.6%CVE-2024-3320LOWSourceCodester eLearning System cross site scriptingEPSS 0.6%CVE-2022-31136MEDIUMCross-site Scripting in BookWyrmEPSS 0.6%CVE-2023-5320CRITICALCross-site Scripting (XSS) - DOM in thorsten/phpmyfaqEPSS 0.6%CVE-2022-47412MEDIUMONLYOFFICE Workspace Search Stored XSSEPSS 0.6%CVE-2024-2145LOWSourceCodester Online Mobile Management Store update-tracker.php cross site scriptingEPSS 0.6%CVE-2022-1819LOWStudent Information System Student Roll Module cross site scriptingEPSS 0.6%CVE-2021-22528HIGHInformation leakage vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1EPSS 0.6%CVE-2023-6128MEDIUMCross-site Scripting (XSS) - Reflected in salesagility/suitecrmEPSS 0.6%CVE-2021-24415—Polo Video Gallery <= 1.2 - Contributor+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2025-47977HIGHNuance Digital Engagement Platform Spoofing VulnerabilityEPSS 0.6%CVE-2021-44201—Cross-site scripting (XSS) was possible in notification pop-upsEPSS 0.6%CVE-2024-13219MEDIUMPolicy Genius <= 2.0.4 - Reflected XSSEPSS 0.6%CVE-2021-3535MEDIUMRapid7 Nexpose is vulnerable to a non-persistent cross-site scripting vulnerability affecting the Security Console's Filtered Asset Search fEPSS 0.6%CVE-2021-23027—On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, and 14.1.x before 14.1.4.3, a DOM based cross-site scripting (XSS) vulnerability EPSS 0.6%