Weaknesses of type CWE-79

29,095 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-74252HIGHJoomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5EPSS 0.5%CVE-2021-4309LOW01-Scripts 01ACP cross site scriptingEPSS 0.5%CVE-2016-15032LOWmback2k mh_httpbl Extension class.tx_mhhttpbl.php stopOutput cross site scriptingEPSS 0.5%CVE-2025-0348MEDIUMCampCodes DepEd Equipment Inventory System add_employee.php cross site scriptingEPSS 0.5%CVE-2026-42897HIGHMicrosoft Exchange Server Spoofing VulnerabilityEPSS 0.5%KEVCVE-2024-4256LOWTechkshetra Info Solutions Savsoft Quiz Category Page editCategory cross site scriptingEPSS 0.5%CVE-2023-1244CRITICALCross-site Scripting (XSS) - Stored in answerdev/answerEPSS 0.5%CVE-2014-125070LOWyanheven console tables.py AvailabilityZonesTable cross site scriptingEPSS 0.5%CVE-2024-4072LOWKashipara Online Furniture Shopping Ecommerce Website search.php cross site scriptingEPSS 0.5%CVE-2021-4312LOWTh3-822 Rapidleech zip.php zip_go cross site scriptingEPSS 0.5%CVE-2023-1804MEDIUMProduct Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSSEPSS 0.5%CVE-2021-37502MEDIUMCross Site Scripting (XSS) vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding EPSS 0.5%CVE-2023-0608MEDIUMCross-site Scripting (XSS) - DOM in microweber/microweberEPSS 0.5%CVE-2024-30979MEDIUMCross Site Scripting vulnerability in Cyber Cafe Management System 1.0 allows a remote attacker to execute arbitrary code via the compname pEPSS 0.5%CVE-2026-73042CRITICALSiYuan before v3.7.4 Remote Code Execution via Menu MetadataEPSS 0.5%CVE-2018-25084LOWPing Identity Self-Service Account Manager SSAMController.java cross site scriptingEPSS 0.5%CVE-2026-73053CRITICALSiYuan before v3.7.4 Cross-Site Scripting via unicode2EmojiEPSS 0.5%CVE-2026-73052CRITICALSiYuan before v3.7.4 Stored XSS via Attribute-View Field NamesEPSS 0.5%CVE-2024-6526MEDIUMCodeIgniter Ecommerce-CodeIgniter-Bootstrap cross site scriptingEPSS 0.5%CVE-2024-21494MEDIUMAll versions of the package github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via the X-Forwarded-For hEPSS 0.5%