Weaknesses of type CWE-79

29,112 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-3420MEDIUMOfficial Integration for Billingo < 3.4.0 - ShopManager+ Stored XSSEPSS 0.5%CVE-2025-40642MEDIUMReflected Cross-Site Scripting (XSS) in WebWorkEPSS 0.5%CVE-2020-23647MEDIUMCross Site Scripting (XSS) vulnerability in BoxBilling 4.19, 4.19.1, 4.20, and 4.21 allows remote attackers to run arbitrary code via the meEPSS 0.5%CVE-2023-5689HIGHCross-site Scripting (XSS) - DOM in modoboa/modoboaEPSS 0.5%CVE-2022-25849MEDIUMCross-site Scripting (XSS)EPSS 0.5%CVE-2023-23951MEDIUMAbility to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the applicationEPSS 0.5%CVE-2024-0599LOWJspxcms Document Management Page InfoController.java cross site scriptingEPSS 0.5%CVE-2025-34318MEDIUMIPFire < v2.29 Stored XSS via DNS Creation (proxy.cgi)EPSS 0.5%CVE-2023-5292MEDIUMAdvanced Custom Fields: Extended <= 0.8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2024-44449MEDIUMCross Site Scripting vulnerability in Quorum onQ OS v.6.0.0.5.2064 allows a remote attacker to obtain sensitive information via the msg paraEPSS 0.5%CVE-2024-0696LOWAtroCore AtroPIM Product Series Overview cross site scriptingEPSS 0.5%CVE-2026-73781HIGHAuthenticated Stored Cross-Site Scripting Vulnerability (XSS) in AOS-CX Web-Based Management InterfaceEPSS 0.5%CVE-2023-23950MEDIUMUser’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses.EPSS 0.5%CVE-2023-7149LOWcode-projects QR Code Generator cross site scriptingEPSS 0.5%CVE-2020-21485MEDIUMCross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to executea arbitrary code via the path parameter in the browEPSS 0.5%CVE-2013-10022LOWBestWebSoft Contact Form Plugin contact_form.php cntctfrm_check_form cross site scriptingEPSS 0.5%CVE-2023-1316MEDIUMCross-site Scripting (XSS) - Stored in osticket/osticketEPSS 0.5%CVE-2015-10121LOWBeeliked Microsite Plugin beelikedmicrosite.php embed_handler cross site scriptingEPSS 0.5%CVE-2023-1349LOWHsycms Add Category Module cate.php cross site scriptingEPSS 0.5%CVE-2024-2071LOWSourceCodester FAQ Management System Update FAQ cross site scriptingEPSS 0.5%