Weaknesses of type CWE-79

28,989 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-4097HIGHCost Calculator Builder Pro <= 3.1.67 - Unauthenticated Cross-Site Scripting via SVG UploadEPSS 0.6%CVE-2024-23186MEDIUME-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. AttackerEPSS 0.6%CVE-2024-32326MEDIUMTOTOLINK EX200 V4.0.3c.7646_B20201211 contains a Cross-site scripting (XSS) vulnerability through the key parameter in the setWiFiExtenderCoEPSS 0.6%CVE-2026-58228MEDIUMScheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>EPSS 0.6%CVE-2024-6585MEDIUMMultiple stored cross-site scripting (“XSS”) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash versEPSS 0.6%CVE-2022-36378MEDIUMWordPress Floating Div plugin <= 3.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2024-2279HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.6%CVE-2026-73374MEDIUMStored Cross-Site Scripting (XSS) via Unescaped CNA Reference Tags in vulnerability-lookupEPSS 0.6%CVE-2024-1010LOWSourceCodester Employee Management System edit-profile.php cross site scriptingEPSS 0.6%CVE-2023-0708MEDIUMMetform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcodeEPSS 0.6%CVE-2022-35882MEDIUMWordPress GS Testimonial Slider plugin <= 1.9.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2026-73427LOWTrix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)EPSS 0.6%CVE-2024-32463HIGHphlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tagsEPSS 0.6%CVE-2023-28850MEDIUMPimcore Perspective Editor vulnerable to Cross-site Scripting in perspective nameEPSS 0.6%CVE-2024-10877MEDIUMAFI – The Easiest Integration Plugin <= 1.92.0 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2023-0112HIGHCross-site Scripting (XSS) - Stored in usememos/memosEPSS 0.6%CVE-2023-47125MEDIUMBy-passing Cross-Site Scripting Protection in HTML SanitizerEPSS 0.6%CVE-2022-39277MEDIUMCross-Site Scripting (XSS) in external links in GLPIEPSS 0.6%CVE-2024-4074LOWKashipara Online Furniture Shopping Ecommerce Website prodInfo.php cross site scriptingEPSS 0.6%CVE-2024-1787MEDIUMContests by Rewards Fuel <= 2.0.64 - Authenticated (Contributor+) Stored Cross-Site Scripting via update_rewards_fuel_api_keyEPSS 0.6%