Weaknesses of type CWE-79

29,096 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-1500LOWcode-projects Simple Art Gallery adminHome.php cross site scriptingEPSS 0.5%CVE-2024-21494MEDIUMAll versions of the package github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via the X-Forwarded-For hEPSS 0.5%CVE-2016-15032LOWmback2k mh_httpbl Extension class.tx_mhhttpbl.php stopOutput cross site scriptingEPSS 0.5%CVE-2023-7215LOWChanzhaoyu chatgpt-web cross site scriptingEPSS 0.5%CVE-2023-48715MEDIUMTuleap vulnerable to Cross-site Scripting on the edition page of a releaseEPSS 0.5%CVE-2023-0608MEDIUMCross-site Scripting (XSS) - DOM in microweber/microweberEPSS 0.5%CVE-2026-73042CRITICALSiYuan before v3.7.4 Remote Code Execution via Menu MetadataEPSS 0.5%CVE-2024-11424MEDIUMSlick Sitemap <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2021-4309LOW01-Scripts 01ACP cross site scriptingEPSS 0.5%CVE-2018-25084LOWPing Identity Self-Service Account Manager SSAMController.java cross site scriptingEPSS 0.5%CVE-2026-73052CRITICALSiYuan before v3.7.4 Stored XSS via Attribute-View Field NamesEPSS 0.5%CVE-2024-4073LOWKashipara Online Furniture Shopping Ecommerce Website prodList.php cross site scriptingEPSS 0.5%CVE-2023-1244CRITICALCross-site Scripting (XSS) - Stored in answerdev/answerEPSS 0.5%CVE-2024-7044MEDIUMStored XSS in open-webui/open-webuiEPSS 0.5%CVE-2023-1536HIGHCross-site Scripting (XSS) - Stored in answerdev/answerEPSS 0.5%CVE-2024-26047MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2023-2302MEDIUMContact Form and Calls To Action by vcita <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2023-6701MEDIUMAdvanced Custom Fields <= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom FieldEPSS 0.5%CVE-2024-26098MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2026-66917HIGHJoomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0EPSS 0.5%