Weaknesses of type CWE-79

29,140 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-66472MEDIUMXWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplicationEPSS 0.5%CVE-2025-0844MEDIUMneedyamin Library Card System Registration Page signup.php cross site scriptingEPSS 0.5%CVE-2022-4667MEDIUMRSS Aggregator by Feedzy < 4.1.1 - Contributor+ Stored XSSEPSS 0.5%CVE-2022-43524HIGHA vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remote attacEPSS 0.5%CVE-2022-45225MEDIUMBook Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book. This vulnEPSS 0.5%CVE-2025-43440MEDIUMThis issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, viEPSS 0.5%CVE-2024-4150MEDIUMSimple Basic Contact Form <= 20221201 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2022-47414MEDIUM If an attacker has access to the console for OpenKM (and is authenticated), a stored XSS vulnerability is reachable in the document "note" EPSS 0.5%CVE-2024-6783MEDIUMVue client-side XSS via prototype pollutionEPSS 0.5%CVE-2023-50630MEDIUMCross Site Scripting (XSS) vulnerability in xiweicheng TMS v.2.28.0 allows a remote attacker to execute arbitrary code via a crafted script EPSS 0.5%CVE-2025-40651MEDIUMReflected Cross Site Scripting (XSS) in Real Easy StoreEPSS 0.5%CVE-2023-3562LOWGZ Scripts PHP CRM Platform index.php cross site scriptingEPSS 0.5%CVE-2023-3561LOWGZ Scripts PHP GZ Hotel Booking Script load.php cross site scriptingEPSS 0.5%CVE-2024-2775LOWCampcodes Online Marriage Registration System user-profile.php cross site scriptingEPSS 0.5%CVE-2021-24584—Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot UpdateEPSS 0.5%CVE-2024-10172MEDIUMWPBakery Visual Composer WHMCS Elements <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via void_wbwhmcse_laouts_search ShortcodeEPSS 0.5%CVE-2023-3558LOWGZ Scripts Event Booking Calendar load.php cross site scriptingEPSS 0.5%CVE-2023-3074HIGHCross-site Scripting (XSS) - Stored in tsolucio/corebosEPSS 0.5%CVE-2023-3557LOWGZ Scripts Property Listing Script preview.php cross site scriptingEPSS 0.5%CVE-2023-28415MEDIUMWordPress Side Cart Woocommerce (Ajax) Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%