Weaknesses of type CWE-79

29,057 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-0534HIGHStored XSS in the value of a part attributeEPSS 0.5%CVE-2024-11435MEDIUMsalavat counter Plugin <= 0.9.4 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2022-1750MEDIUMSticky Popup <= 1.2 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-3414LOWSourceCodester Human Resource Information System addcorporate_process.php cross site scriptingEPSS 0.5%CVE-2021-32764HIGHYouTube Onebox susceptible to XSSEPSS 0.5%CVE-2015-10075LOWCustom-Content-Width custom-content-width.php register_settings cross site scriptingEPSS 0.5%CVE-2024-52281HIGHStored Cross-site Scripting vulnerability in Rancher UIEPSS 0.5%CVE-2022-39016HIGHJavascript injection in PDFtron in M-Files HubshareEPSS 0.5%CVE-2022-2517MEDIUMBeaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via Caption - On HoverEPSS 0.5%CVE-2024-2072LOWSourceCodester Flashcard Quiz App update-flashcard.php cross site scriptingEPSS 0.5%CVE-2023-7166LOWNovel-Plus HTTP POST Request updateUserInfo cross site scriptingEPSS 0.5%CVE-2023-46951MEDIUMCross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted paylEPSS 0.5%CVE-2014-125105LOWBroken Link Checker Plugin Settings Page core.php options_page cross site scriptingEPSS 0.5%CVE-2015-10094LOWFastly Plugin api.php post cross site scriptingEPSS 0.5%CVE-2024-3415LOWSourceCodester Human Resource Information System addbranches_process.php cross site scriptingEPSS 0.5%CVE-2025-25747MEDIUMCross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive infoEPSS 0.5%CVE-2021-44775MEDIUMCross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attacEPSS 0.5%CVE-2022-0705MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.5%CVE-2022-4560LOWJoget wflow-core UniversalTheme.java getInternalJsCssLib cross site scriptingEPSS 0.5%CVE-2024-2773LOWCampcodes Online Marriage Registration System search.php cross site scriptingEPSS 0.5%