Weaknesses of type CWE-79

29,112 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-6366HIGHWhatsUp Gold Stored Cross-Site Scripting (XSS) via Alert CenterEPSS 0.5%CVE-2025-1174MEDIUM1000 Projects Bookstore Management System Add Book Page process_book_add.php cross site scriptingEPSS 0.5%CVE-2023-32685MEDIUMClipboard based cross-site scripting (blocked with default CSP) in KanboardEPSS 0.5%CVE-2024-21724MEDIUM[20240203] - Core - XSS in media selection fieldsEPSS 0.5%CVE-2026-18481MEDIUMStored XSS in Participant URL Field leads to Account Takeover via Session Token TheftEPSS 0.5%CVE-2023-7315MEDIUMNagios XI < 5.11.3 XSS via Graph ExplorerEPSS 0.5%CVE-2023-6365HIGHWhatsUp Gold Stored Cross-Site Scripting (XSS) via Device GroupsEPSS 0.5%CVE-2024-2779LOWCampcodes Online Marriage Registration System application-bwdates-reports-details.php cross site scriptingEPSS 0.5%CVE-2023-6367HIGHWhatsUp Gold Stored Cross-Site Scripting (XSS) via RolesEPSS 0.5%CVE-2023-1767MEDIUMThe Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is toEPSS 0.5%CVE-2023-6364HIGHWhatsUp Gold Stored Cross-Site Scripting (XSS) via DashboardEPSS 0.5%CVE-2023-0314MEDIUMCross-site Scripting (XSS) - Reflected in thorsten/phpmyfaqEPSS 0.5%CVE-2022-46968MEDIUMA stored cross-site scripting (XSS) vulnerability in /index.php?page=help of Revenue Collection System v1.0 allows attackers to execute arbiEPSS 0.5%CVE-2023-23470MEDIUMIBM i privilege escalationEPSS 0.5%CVE-2025-4611MEDIUMSlim SEO <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via slim_seo_breadcrumbs ShortcodeEPSS 0.5%CVE-2023-0327LOWsaemorris TheRadSystem users.php cross site scriptingEPSS 0.5%CVE-2022-4822LOWFlatPress Setup main.lib.php cross site scriptingEPSS 0.5%CVE-2022-37339MEDIUMWordPress Meet My Team plugin <= 2.0.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2024-1894MEDIUMBurst Statistics – Privacy-Friendly Analytics for WordPress <= 1.5.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via burst_total_pageviews_countEPSS 0.5%CVE-2022-4821LOWFlatPress XML File Handler/MD File admin.uploader.php onupload cross site scriptingEPSS 0.5%