Weaknesses of type CWE-79

29,224 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-1143CRITICALCentral Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and sEPSS 0.5%CVE-2023-7225MEDIUMMapPress <= 2.88.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map SettingsEPSS 0.5%CVE-2023-7135LOWcode-projects Record Management System Offices offices.php cross site scriptingEPSS 0.5%CVE-2022-40841MEDIUMA cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTMEPSS 0.5%CVE-2023-23326MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability exists in AvantFAX 3.3.7. An authenticated low privilege user can inject arbitrary JavascrEPSS 0.5%CVE-2023-6075LOWPHPGurukul Restaurant Table Booking System Reservation Request index.php cross site scriptingEPSS 0.5%CVE-2023-7136LOWcode-projects Record Management System Document Type doctype.php cross site scriptingEPSS 0.5%CVE-2023-4983MEDIUMapp1pro Shopicial search cross site scriptingEPSS 0.5%CVE-2022-36057MEDIUMDiscourse-Chat Cross-Site Scripting issue for channel names and descriptionsEPSS 0.5%CVE-2024-30883MEDIUMReflected Cross Site Scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML aEPSS 0.5%CVE-2024-7929MEDIUMSourceCodester Simple Forum Website Signup Page registration.php cross site scriptingEPSS 0.5%CVE-2026-35198CRITICALHeyForm vulnerable to stored XSS via form field titlesEPSS 0.5%CVE-2026-45343HIGHLinkAce - Stored XSS via Unsanitized SSO User's Name Rendered in Admin Audit Log Allows Session HijackingEPSS 0.5%CVE-2023-6098MEDIUMCross-site Scripting on ICSSolution ICS Business ManagerEPSS 0.5%CVE-2024-7649MEDIUMOpal Membership <= 1.2.4 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-27734MEDIUMA Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows an attacker to execute arbitrary code via a crafted script to the Site Name fEPSS 0.5%CVE-2022-39373MEDIUMStored Cross-Site Scripting (XSS) in entity name in GLPIEPSS 0.5%CVE-2023-3672HIGHCross-site Scripting (XSS) - DOM in plaidweb/webmention.jsEPSS 0.5%CVE-2022-3516MEDIUMCross-site Scripting (XSS) - Stored in librenms/librenmsEPSS 0.5%CVE-2025-46729LOWphpDVDProfiler Cross-site Scripting vulnerabilityEPSS 0.5%