Weaknesses of type CWE-79

29,055 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-32858MEDIUMesdoc-publish-html-plugin vulnerable to Cross-site ScriptingEPSS 0.6%CVE-2023-1115HIGHCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.6%CVE-2026-63523MEDIUMSkype for Business Spoofing VulnerabilityEPSS 0.6%CVE-2016-15010LOWUniversity of Cambridge django-ucamlookup Lookup cross site scriptingEPSS 0.6%CVE-2023-5741MEDIUMPOWR <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2024-40857MEDIUMThis issue was addressed through improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 1EPSS 0.6%CVE-2023-4775MEDIUMAdvanced iFrame <= 2023.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.6%CVE-2024-26077MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.6%CVE-2023-5880HIGHCross-site Scripting (XSS) injected into Aladdin Connect garage door opener (Retrofit-Kit) configuration setup webserver console via broadcast SSID nameEPSS 0.6%CVE-2025-55300HIGHKomari Allows Cross-site WebSocket HijackingEPSS 0.6%CVE-2023-1238HIGHCross-site Scripting (XSS) - Stored in answerdev/answerEPSS 0.6%CVE-2020-21246MEDIUMCross Site Scripting vulnerability in YiiCMS v.1.0 allows a remote attacker to execute arbitrary code via the news function.EPSS 0.6%CVE-2025-66921HIGHA Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to inEPSS 0.6%CVE-2024-2270MEDIUMkeerti1924 Online-Book-Store-Website signup.php cross site scriptingEPSS 0.6%CVE-2022-24708MEDIUMStored XSS vulnerability in anuko/timetrackerEPSS 0.6%CVE-2026-4637MEDIUMReflected Cross-Site Scripting via URL Path in Paessler PRTG Network MonitorEPSS 0.6%CVE-2024-3728MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery & Interactive CircleEPSS 0.6%CVE-2015-10093LOWMark User as Spammer Plugin plugin.php user_row_actions cross site scriptingEPSS 0.6%CVE-2023-0709MEDIUMMetform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcodeEPSS 0.6%CVE-2021-1153MEDIUMCisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Stored Cross-Site Scripting VulnerabilitiesEPSS 0.6%