Weaknesses of type CWE-79

29,055 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-25147CRITICALCross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, andEPSS 0.6%CVE-2022-38460MEDIUMWordPress NOTICE BOARD plugin <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.6%CVE-2024-22936MEDIUMCross-site scripting (XSS) vulnerability in Parents & Student Portal in Genesis School Management Systems in Genesis AIMS Student InformatioEPSS 0.6%CVE-2024-0283LOWKashipara Food Management System party_details.php cross site scriptingEPSS 0.6%CVE-2024-3140LOWSourceCodester Computer Laboratory Management System cross site scriptingEPSS 0.6%CVE-2022-2934MEDIUMBeaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Image URLEPSS 0.6%CVE-2022-45217MEDIUMA cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML EPSS 0.6%CVE-2024-36498MEDIUMStored cross site scriptingEPSS 0.6%CVE-2025-1239MEDIUMWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Blocked Sites ListEPSS 0.6%CVE-2026-40545MEDIUMReflected XSS in SOPlanningEPSS 0.6%CVE-2026-46594MEDIUMReflected XSS in PHP Poll ScriptEPSS 0.6%CVE-2026-6909MEDIUMReflected XSS in ATutorEPSS 0.6%CVE-2022-2716MEDIUMBeaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Text EditorEPSS 0.6%CVE-2025-70336MEDIUMA Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote attackers to inject arbiEPSS 0.6%CVE-2026-6956MEDIUMReflected XSS in ATutorEPSS 0.6%CVE-2022-42710MEDIUMNice (formerly Nortek) Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e devices are vulnerabEPSS 0.6%CVE-2026-11772MEDIUMReflected XSS in DRIMO CMSEPSS 0.6%CVE-2026-9585HIGHUnauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web PortalEPSS 0.6%CVE-2024-9371MEDIUMBranda – White Label & Branding, Custom Login Page Customizer <= 3.4.19 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2020-21052MEDIUMCross Site Scripting vulnerability in zrlog zrlog v.2.1.3 allows a remote attacker to execute arbitrary code via the nickame parameter of thEPSS 0.6%