Weaknesses of type CWE-79

29,071 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-39050MEDIUMPossible XSS stored in customer informationEPSS 0.5%CVE-2025-9642HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.5%CVE-2022-4525LOWNational Sleep Research Resource sleepdata.org cross site scriptingEPSS 0.5%CVE-2022-37310MEDIUMOX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /#!!&app=io.ox/files&cEPSS 0.5%CVE-2021-4263LOWleanote history.js define cross site scriptingEPSS 0.5%CVE-2020-11062MEDIUMReflexive XSS in GLPIEPSS 0.5%CVE-2024-2135LOWBdtask Hospita AutoManager Hospital Activities Page form cross site scriptingEPSS 0.5%CVE-2023-6954MEDIUMDownload Manager <= 3.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2024-53617MEDIUMA Cross Site Scripting vulnerability in LibrePhotos before commit 32237 allows attackers to takeover any account via uploading an HTML file EPSS 0.5%CVE-2025-4805MEDIUMWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Acces Portal ConfigurationEPSS 0.5%CVE-2024-3341MEDIUMShortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aux_gmaps' ShortcodeEPSS 0.5%CVE-2024-3724MEDIUMHappy Addons for Elementor <= 3.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group, Photo Stack, & Horizontal TimelineEPSS 0.5%CVE-2017-5258—In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows or can guess the RW community string can provide a URL forEPSS 0.5%CVE-2022-3211MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.5%CVE-2022-34656MEDIUMWordPress Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 - Authenticated Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2024-41914HIGHA vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conEPSS 0.5%CVE-2023-5351HIGHCross-site Scripting (XSS) - Stored in salesagility/suitecrmEPSS 0.5%CVE-2024-52612MEDIUMSolarWinds Platform Reflected Cross-Site Scripting VulnerabilityEPSS 0.5%CVE-2023-48705HIGHnautobot has XSS potential in custom links, job buttons, and computed fieldsEPSS 0.5%CVE-2023-29322MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.5%