Weaknesses of type CWE-79

28,993 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-0782LOWCodeAstro Online Railway Reservation System pass-profile.php cross site scriptingEPSS 0.6%CVE-2022-29444MEDIUMWordPress Breeze plugin <= 2.0.2 - Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2022-25612MEDIUMWordPress Simple Event Planner plugin <= 1.5.4 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.6%CVE-2024-11660MEDIUMcode-projects Farmacia usuario.php cross site scriptingEPSS 0.6%CVE-2025-65717MEDIUMAn issue in Visual Studio Code Extensions Live Server v5.7.9 allows attackers to exfiltrate files via user interaction with a crafted HTML pEPSS 0.6%CVE-2023-3815LOWy_project RuoYi File Upload uploadFilesPath cross site scriptingEPSS 0.6%CVE-2013-10026LOWMail Subscribe List Plugin index.php cross site scriptingEPSS 0.6%CVE-2021-38468HIGHInHand Networks IR615 RouterEPSS 0.6%CVE-2020-21058MEDIUMCross Site Scripting vulnerability in Typora v.0.9.79 allows a remote attacker to execute arbitrary code via the mermaid sytax.EPSS 0.6%CVE-2024-1834LOWSourceCodester Simple Student Attendance System ?page=attendance&class_id=1 cross site scriptingEPSS 0.6%CVE-2023-22461HIGHsanitize-svg Filter Bypass Allows Cross-Site Scripting (XSS)EPSS 0.6%CVE-2023-24065MEDIUMNOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name (of a physician, assistant, or billing user) can have a JEPSS 0.6%CVE-2024-3428LOWSourceCodester Online Courseware edit.php cross site scriptingEPSS 0.6%CVE-2026-45381MEDIUMTautulli: Reflected XSS in `/search` endpointEPSS 0.6%CVE-2021-36832MEDIUMWordPress Icegram plugin <= 2.0.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2023-3784LOWDooblou WiFi File Explorer cross site scriptingEPSS 0.6%CVE-2023-27515HIGHCross-site scripting (XSS) for the Intel(R) DSA software before version 23.1.9 may allow unauthenticated user to potentially enable escalatiEPSS 0.6%CVE-2024-11986CRITICALStored XSS in CrushFTPEPSS 0.6%CVE-2022-4524LOWRoots soil Plugin CleanUpModule.php language_attributes cross site scriptingEPSS 0.6%CVE-2026-45797MEDIUMHeyForm Vulnerable to Stored XSS via Unauthenticated SVG File UploadEPSS 0.6%