Weaknesses of type CWE-79

29,079 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-9900MEDIUMCross-Site Scripting (XSS) in mudler/localaiEPSS 0.5%CVE-2022-2686LOWoretnom23 Fast Food Ordering System Menu List Page cross site scriptingEPSS 0.5%CVE-2024-2075LOWSourceCodester Daily Habit Tracker update-tracker.php cross site scriptingEPSS 0.5%CVE-2023-2452MEDIUMAdvanced Woo Search <= 2.77 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2022-43369MEDIUMAutoTaxi Stand Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component search.php.EPSS 0.5%CVE-2022-27230HIGHOn all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP APM, and F5 BIG-IP Guided Configuration (GC) all versionsEPSS 0.5%CVE-2022-2689LOWSourceCodester Wedding Hall Booking System Contact Page cross site scriptingEPSS 0.5%CVE-2023-0553MEDIUMQuick Restaurant Menu <= 2.0.2 - Authenticated (Administrator+) Cross-Site ScriptingEPSS 0.5%CVE-2024-2715LOWCampcodes Complete Online DJ Booking System user-search.php cross site scriptingEPSS 0.5%CVE-2024-39403HIGHStored XSS through Webhook module public key configurationEPSS 0.5%CVE-2009-10002LOWdpup fittr-flickr EXIF Preview easy-exif.js cross site scriptingEPSS 0.5%CVE-2023-1041LOWSourceCodester Simple Responsive Tourism Website rate_review.php cross site scriptingEPSS 0.5%CVE-2024-0618MEDIUMFluent Forms <= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form titleEPSS 0.5%CVE-2024-2526LOWMAGESH-K21 Online-College-Event-Hall-Reservation-System rooms.php cross site scriptingEPSS 0.5%CVE-2023-25831MEDIUMBUG-000154236 There is a reflected cross-site scripting (XSS) vulnerability in Portal for ArcGIS.EPSS 0.5%CVE-2026-14334HIGHBooking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File UploadEPSS 0.5%CVE-2024-11440MEDIUMGrey Owl Lightbox <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-50803MEDIUMThe mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker EPSS 0.5%CVE-2023-1535HIGHCross-site Scripting (XSS) - Stored in answerdev/answerEPSS 0.5%CVE-2015-10049LOWOverdrive Eletrônica course-builder oeditor.html cross site scriptingEPSS 0.5%