Weaknesses of type CWE-79

28,989 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-0806MEDIUMcode-projects Job Recruitment _call_job_search_ajax.php cross site scriptingEPSS 0.6%CVE-2016-2138—In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in xss_clean() in class/KippoInput.class.php.EPSS 0.6%CVE-2023-47125MEDIUMBy-passing Cross-Site Scripting Protection in HTML SanitizerEPSS 0.6%CVE-2024-4075LOWKashipara Online Furniture Shopping Ecommerce Website login.php cross site scriptingEPSS 0.6%CVE-2022-39277MEDIUMCross-Site Scripting (XSS) in external links in GLPIEPSS 0.6%CVE-2023-0446MEDIUMMy YouTube Channel <= 3.0.12.1 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-5013LOWPluck CMS Installation install.php cross site scriptingEPSS 0.6%CVE-2022-2213LOWSourceCodester Library Management System cross site scriptingEPSS 0.6%CVE-2022-1817LOWBadminton Center Management System Userlist Module cross site scriptingEPSS 0.6%CVE-2024-23604MEDIUMCross-site scripting vulnerability exists in FitNesse all releases, which may allow a remote unauthenticated attacker to execute an arbitrarEPSS 0.6%CVE-2024-22780MEDIUMCross Site Scripting vulnerability in CA17 TeamsACS v.1.0.1 allows a remote attacker to execute arbitrary code via a crafted script to the eEPSS 0.6%CVE-2024-10761MEDIUMUmbraco CMS Dashboard frame cross site scriptingEPSS 0.6%CVE-2023-3183LOWSourceCodester Performance Indicator System addproduct.php cross site scriptingEPSS 0.6%CVE-2023-50717MEDIUMNocoDB Allows Preview of File with Dangerous ContentEPSS 0.6%CVE-2023-49983MEDIUMA cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to execEPSS 0.6%CVE-2025-7887MEDIUMZavy86 WikiDocs template.inc.php cross site scriptingEPSS 0.6%CVE-2023-49539MEDIUMBook Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/category. This EPSS 0.6%CVE-2024-1535MEDIUMProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2026-42509MEDIUMApache Wicket: crafted strings can break out of the JavaScript sequenceEPSS 0.6%CVE-2024-48761HIGHReflected XSS vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary JavaScript code via the "erEPSS 0.6%