Weaknesses of type CWE-79

29,071 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-6524MEDIUMMapPress Maps for WordPress <= 2.88.13 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2026-95665MEDIUMMISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSONEPSS 0.5%CVE-2024-27703MEDIUMCross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do title parameter.EPSS 0.5%CVE-2024-12983MEDIUMcode-projects Hospital Management System Edit Doctor Details Page manage-doctors.php cross site scriptingEPSS 0.5%CVE-2023-1572LOWDataGear Plugin cross site scriptingEPSS 0.5%CVE-2023-29322MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.5%CVE-2023-28598HIGHZoom for Linux clients prior to 5.13.10 contain an HTML injection vulnerability. If a victim starts a chat with a malicious user it could rEPSS 0.5%CVE-2023-27000MEDIUMCross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the name paramEPSS 0.5%CVE-2026-2472HIGHStored Cross-Site Scripting (XSS) in Vertex AI Python SDK VisualizationEPSS 0.5%CVE-2024-1266LOWCodeAstro University Management System Student Registration Form st_reg.php cross site scriptingEPSS 0.5%CVE-2024-3091LOWPHPGurukul Emergency Ambulance Hiring Portal Search Request Page search.php cross site scriptingEPSS 0.5%CVE-2024-28106MEDIUMphpMyFAQ Stored XSS at FAQ News ContentEPSS 0.5%CVE-2023-3620MEDIUMCross-site Scripting (XSS) - Stored in amauric/tarteaucitron.jsEPSS 0.5%CVE-2024-0284LOWKashipara Food Management System party_submit.php cross site scriptingEPSS 0.5%CVE-2022-0966MEDIUMStored XSS via File Upload in star7th/showdoc in star7th/showdocEPSS 0.5%CVE-2025-53484CRITICALSecurePoll: Multiple locations vulnerable to Cross-Site Scripting (XSS) via unescaped inputEPSS 0.5%CVE-2022-45028MEDIUMA cross-site scripting (XSS) vulnerability in Arris NVG443B 9.3.0h3d36 allows attackers to execute arbitrary web scripts or HTML via a craftEPSS 0.5%CVE-2022-33929MEDIUMDell Wyse Management Suite 3.6.1 and below contains a Reflected Cross-Site Scripting Vulnerability in EndUserSummary page. An authenticated EPSS 0.5%CVE-2023-5128MEDIUMTCD Google Maps <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2023-5234MEDIUMRelated Products for WooCommerce <= 3.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%