Weaknesses of type CWE-79

29,035 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-3561MEDIUMCross-site Scripting (XSS) - Generic in librenms/librenmsEPSS 0.6%CVE-2022-3237MEDIUMWP Contact Slider < 2.4.8 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2024-35592CRITICALAn arbitrary file upload vulnerability in the Upload function of Box-IM v2.0 allows attackers to execute arbitrary code via uploading a crafEPSS 0.6%CVE-2023-34103HIGHStored XSS (Cross Site Scripting) in html content based fields of avoEPSS 0.6%CVE-2022-3469MEDIUMWP Attachments < 5.0.5 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2010-10008LOWsimplesamlphp simplesamlphp-module-openidprovider trust.tpl.php cross site scriptingEPSS 0.6%CVE-2025-1763HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.6%CVE-2021-43991MEDIUMPersistent XSS via Avatar Upload in Kentico Xperience CMSEPSS 0.6%CVE-2026-41201CRITICALCI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2EPSS 0.6%CVE-2022-3462MEDIUMHighlight Focus <= 1.1 - Admin+ Stored Cross Site ScriptingEPSS 0.6%CVE-2022-28353MEDIUMIn the External Redirect Warning Plugin 1.3 for MyBB, the redirect URL (aka external.php?url=) is vulnerable to XSS.EPSS 0.6%CVE-2022-3408MEDIUMWP Word Count <= 3.2.3 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-4740LOWkkFileView picturesPreview setWatermarkAttribute cross site scriptingEPSS 0.6%CVE-2024-25145CRITICALStored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, anEPSS 0.6%CVE-2024-50836MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/teachers.php in KASHIPARA E-learning Management System Project 1.0. ThEPSS 0.6%CVE-2021-36866MEDIUMWordPress Easy Pricing Tables plugin <= 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2023-2322MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.6%CVE-2022-25605MEDIUMWordPress WP-DownloadManager plugin <= 1.68.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.6%CVE-2022-4519MEDIUMWP User <= 7.0 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-41541—A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V1EPSS 0.6%