Weaknesses of type CWE-79

29,100 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2020-7258MEDIUMNetwork Security Management (NSM) - Cross site scripting vulnerabilityEPSS 0.5%CVE-2025-28906MEDIUMWordPress Skitter Slideshow plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2023-49277HIGHReflected Cross-site Scripting Vulnerability in dpasteEPSS 0.5%CVE-2023-1609LOWZhong Bang CRMEB Java save cross site scriptingEPSS 0.5%CVE-2023-3071HIGHCross-site Scripting (XSS) - Stored in tsolucio/corebosEPSS 0.5%CVE-2020-7256MEDIUMNetwork Security Management (NSM) - Cross site scripting vulnerabilityEPSS 0.5%CVE-2024-43368MEDIUMTrix has a Cross-Site Scripting (XSS) vulnerability on copy & pasteEPSS 0.5%CVE-2024-42787MEDIUMA Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System vEPSS 0.5%CVE-2024-7660MEDIUMSourceCodester File Manager App Add File cross site scriptingEPSS 0.5%CVE-2024-50969MEDIUMA Reflected cross-site scripting (XSS) vulnerability in browse.php of Code-projects Jonnys Liquor 1.0 allows remote attackers to inject arbiEPSS 0.5%CVE-2025-25461MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can injEPSS 0.5%CVE-2023-5577MEDIUMBitly's WordPress Plugin <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2022-35654MEDIUMPega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.EPSS 0.5%CVE-2020-7333MEDIUMCross-site Scripting (XSS) in firewall ePO extension of McAfee Endpoint Security (ENS)EPSS 0.5%CVE-2024-2733MEDIUMBold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Separator ElementEPSS 0.5%CVE-2023-41318MEDIUMUnsafe media served inline on download endpoints in matrix-media-repoEPSS 0.5%CVE-2018-25119MEDIUMNagios Fusion < 4.1.5 XSS via fusionwindow ParameterEPSS 0.5%CVE-2021-47694MEDIUMNagios XI < 5.8.6 Core Config Manager (CCM) Reflected XSS via Test CommandEPSS 0.5%CVE-2023-22910MEDIUMAn issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. There is XSS in Wikibase EPSS 0.5%CVE-2025-56515HIGHFile upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG fiEPSS 0.5%