Weaknesses of type CWE-79

28,988 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-3768MEDIUMCross-site Scripting (XSS) - Stored in bookstackapp/bookstackEPSS 0.6%CVE-2025-66481CRITICALDeepChat's Incomplete XSS Fix Allows RCE through Mermaid ContentEPSS 0.6%CVE-2025-22465MEDIUMReflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execEPSS 0.6%CVE-2026-62948CRITICALOpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UIEPSS 0.6%CVE-2019-25144MEDIUMWP HTML Mail < 2.2.11 - HTML injectionEPSS 0.6%CVE-2026-13424HIGHOnline Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX actionEPSS 0.6%CVE-2022-20629MEDIUMCisco Firepower Management Center Software Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2022-20741MEDIUMCisco Secure Network Analytics Network Diagrams Application Cross-Site Scripting VulnerabilityEPSS 0.6%CVE-2022-48150MEDIUMShopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI.EPSS 0.6%CVE-2022-4692HIGHCross-site Scripting (XSS) - Stored in usememos/memosEPSS 0.6%CVE-2022-20627MEDIUMCisco Firepower Management Center Software Cross-Site Scripting VulnerabilitiesEPSS 0.6%CVE-2021-3767MEDIUMCross-site Scripting (XSS) - Stored in bookstackapp/bookstackEPSS 0.6%CVE-2021-4372MEDIUMWooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Stored Cross-Site ScriptingEPSS 0.6%CVE-2025-26210HIGHDeepSeek R1 through V3.1 allows XSS, as demonstrated by JavaScript execution in the context of the run-html-chat.deepseeksvc.com domain. NOTEPSS 0.6%CVE-2023-33962MEDIUMJStachio XSS vulnerability: Unescaped single quotesEPSS 0.6%CVE-2023-27130MEDIUMCross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via an arbitrarily supplied UEPSS 0.6%CVE-2014-125035LOWJobs-Plugin cross site scriptingEPSS 0.6%CVE-2022-38198MEDIUMBUG-000146513 - Reflected XSS vulnerability in ArcGIS ServerEPSS 0.6%CVE-2024-25868MEDIUMA Cross Site Scripting (XSS) vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrEPSS 0.6%CVE-2024-8604MEDIUMSourceCodester Online Food Ordering System Create an Account Page index.php cross site scriptingEPSS 0.6%