Weaknesses of type CWE-79

29,225 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-29031HIGHRockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting AttackEPSS 0.5%CVE-2026-27645MEDIUMchangedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error ResponseEPSS 0.5%CVE-2023-30093MEDIUMA cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbiEPSS 0.5%CVE-2022-35630—Unsafe HTML Injection in Artifact Collection ReportEPSS 0.5%CVE-2022-45223MEDIUMWeb-Based Student Clearance System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /Admin/add-student.php. ThisEPSS 0.5%CVE-2022-1340HIGHCross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmEPSS 0.5%CVE-2026-45343HIGHLinkAce - Stored XSS via Unsanitized SSO User's Name Rendered in Admin Audit Log Allows Session HijackingEPSS 0.5%CVE-2023-4983MEDIUMapp1pro Shopicial search cross site scriptingEPSS 0.5%CVE-2023-6371HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.5%CVE-2023-29023HIGHRockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting AttackEPSS 0.5%CVE-2026-35198CRITICALHeyForm vulnerable to stored XSS via form field titlesEPSS 0.5%CVE-2022-3516MEDIUMCross-site Scripting (XSS) - Stored in librenms/librenmsEPSS 0.5%CVE-2023-29030HIGHRockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting AttackEPSS 0.5%CVE-2024-27734MEDIUMA Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows an attacker to execute arbitrary code via a crafted script to the Site Name fEPSS 0.5%CVE-2025-8221MEDIUMjerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsCustController.java goodsSearch cross site scriptingEPSS 0.5%CVE-2024-7685MEDIUMSourceCodester Kortex Lite Advocate Office Management System adds.php cross site scriptingEPSS 0.5%CVE-2025-7430HIGHStored XSSEPSS 0.5%CVE-2026-3962MEDIUMJcharis Machine-Learning-Web-Apps Jinja2 Template app.py render_template cross site scriptingEPSS 0.5%CVE-2014-125089LOWcention-chatserver InternalChatProtocol.fe _formatBody cross site scriptingEPSS 0.5%CVE-2026-81825HIGHSimple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.5%