Weaknesses of type CWE-79

29,081 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-58647HIGHMicrosoft PowerBI Report Server Spoofing VulnerabilityEPSS 0.5%CVE-2023-1613LOWRebuild publish cross site scriptingEPSS 0.5%CVE-2025-66562HIGHTUUI vulnerable to Remote Code Execution (RCE) via XSS in Markdown ECharts RenderingEPSS 0.5%CVE-2025-26796MEDIUMApache Oozie: XSS in Oozie Web ConsoleEPSS 0.5%CVE-2021-36849LOWWordPress Social Media Share Buttons plugin <= 3.8.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2023-2475LOWDromara J2eeFAST System Message cross site scriptingEPSS 0.5%CVE-2024-47924HIGHBoa web server – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.5%CVE-2025-64716MEDIUMAnubis vulnerable to possible XSS via redir parameter when using subrequest auth modeEPSS 0.5%CVE-2024-27499MEDIUMBagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option.EPSS 0.5%CVE-2025-51504HIGHMicroweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field.EPSS 0.5%CVE-2023-38687MEDIUMExecution of arbitrary JavaScript from Svelecte item namesEPSS 0.5%CVE-2022-37925MEDIUMA vulnerability within the web-based management interface of Aruba EdgeConnect Enterprise could allow a remote attacker to conduct a reflectEPSS 0.5%CVE-2026-85061CRITICALMapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal SkipEPSS 0.5%CVE-2026-24053HIGHCluade Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File WritesEPSS 0.5%CVE-2023-1245LOWCross-site Scripting (XSS) - Stored in answerdev/answerEPSS 0.5%CVE-2022-34879MEDIUMVICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple Cross Site Scripting (XSS) vulnerabilities at /vicidial/admin.php.EPSS 0.5%CVE-2023-33939MEDIUMCross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fEPSS 0.5%CVE-2022-4930LOWnuxsmin sysPass URL cross site scriptingEPSS 0.5%CVE-2024-1379MEDIUMWebsite Article Monetization By MageNet <= 1.0.11 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-32578HIGHWordPress Sliderby10Web plugin <= 1.2.54 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.5%