Weaknesses of type CWE-79

29,072 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-5469MEDIUMDrop Shadow Boxes <= 1.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2023-5662MEDIUMSponsors <= 3.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2023-36474HIGHInteractsh server settings make users vulnerable to Subdomain TakeoverEPSS 0.5%CVE-2024-1022LOWCodeAstro Simple Student Result Management System Add Class Page add_classes.php cross site scriptingEPSS 0.5%CVE-2024-47095MEDIUMReflected Cross-Site Scripting in Follet School Solutions DestinyEPSS 0.5%CVE-2023-24081MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in Redrock Software TutorTrac before v4.2.170210 allows attackers to execute arbiEPSS 0.5%CVE-2024-3081LOWEasyCorp EasyAdmin Autocomplete autocomplete.js cross site scriptingEPSS 0.5%CVE-2021-27479—ZOLL Defibrillator Dashboard, v prior to 2.2,The affected product’s web application could allow a low privilege user to inject parameters toEPSS 0.5%CVE-2025-1155MEDIUMWebkul QloApps Your Location Search stores cross site scriptingEPSS 0.5%CVE-2024-0184LOWRRJ Nueva Ecija Engineer Online Portal Add Enginer edit_teacher.php cross site scriptingEPSS 0.5%CVE-2024-0445MEDIUMThe Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-0189LOWRRJ Nueva Ecija Engineer Online Portal Create Message teacher_message.php cross site scriptingEPSS 0.5%CVE-2021-39428MEDIUMCross Site Scripting (XSS) vulnerability in Users.php in eyoucms 1.5.4 allows remote attackers to run arbitrary code and gain escalated privEPSS 0.5%CVE-2024-52286LOWSelf Cross Site Scripting (XSS) In Merge Functionality in Stirling-PDFEPSS 0.5%CVE-2024-28108MEDIUMphpMyFAQ Stored HTML Injection at contentLinkEPSS 0.5%CVE-2023-1796LOWSourceCodester Employee Payslip Generator Create News cross site scriptingEPSS 0.5%CVE-2024-41333MEDIUMA reflected cross-site scripting (XSS) vulnerability in Phpgurukul Tourism Management System v2.0 allows attackers to execute arbitrary codeEPSS 0.5%CVE-2022-29449MEDIUMWordPress Opal Hotel Room Booking plugin <= 1.2.7 - Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2023-44854MEDIUMCross Site Scripting (XSS) vulnerability in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafteEPSS 0.5%CVE-2022-4242MEDIUMWP Google Review Slider < 11.6 - Admin+ Stored XSSEPSS 0.5%