Weaknesses of type CWE-79

29,189 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-27088HIGHReflected Cross-site Scripting (XSS) in template implementation in oxyno-zeta/s3-proxyEPSS 0.5%CVE-2022-46622MEDIUMA cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via aEPSS 0.5%CVE-2026-12811MEDIUMkortix-ai suna Auth Endpoint page.tsx router.push cross site scriptingEPSS 0.5%CVE-2022-47418MEDIUMLogicalDOC Document Version Comment Stored XSSEPSS 0.5%CVE-2023-2616MEDIUMCross-site Scripting (XSS) - Generic in pimcore/pimcoreEPSS 0.5%CVE-2024-8274MEDIUMWP Booking Calendar <= 10.5 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2024-7749MEDIUMSourceCodester Accounts Manager App add-account.php cross site scriptingEPSS 0.5%CVE-2023-33495MEDIUMCraft CMS through 4.4.9 is vulnerable to HTML Injection.EPSS 0.5%CVE-2025-5352HIGHEnvironment Variable XSS in Analytics Component in lunary-ai/lunaryEPSS 0.5%CVE-2023-7050LOWPHPGurukul Online Notes Sharing System profile.php cross site scriptingEPSS 0.5%CVE-2022-47417MEDIUMLogicalDOC Document File Name Stored XSSEPSS 0.5%CVE-2023-2615MEDIUMCross-site Scripting (XSS) - Reflected in pimcore/pimcoreEPSS 0.5%CVE-2024-50849MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote authenticated attackerEPSS 0.5%CVE-2023-4493MEDIUMEasy Address Book Web Server Stored XSS vulnerabilityEPSS 0.5%CVE-2024-41677MEDIUMCross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwikEPSS 0.5%CVE-2022-45729MEDIUMA cross-site scripting (XSS) vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute arbitrary web scripts EPSS 0.5%CVE-2026-56397CRITICALSiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and READMEEPSS 0.5%CVE-2023-32291MEDIUMWordPress MonsterInsights Pro Plugin <= 8.14.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2024-0838MEDIUMHappy Addons for Elementor <= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2025-31675MEDIUMDrupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004EPSS 0.5%