Weaknesses of type CWE-79

29,250 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-8554MEDIUMSourceCodester Clinics Patient Management System users.php cross site scriptingEPSS 0.5%CVE-2025-7429HIGHStored XSSEPSS 0.5%CVE-2022-42993MEDIUMPassword Storage Application v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Setup page.EPSS 0.5%CVE-2024-11901MEDIUMPowerBI Embed Reports <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-7524MEDIUMFirefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. On a site protected by ContEPSS 0.5%CVE-2025-26907HIGHWordPress Estatik Mortgage Calculator plugin <= 2.0.12 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2022-42992MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in Train Scheduler App v1.0 allow attackers to execute arbitrary web scripts or HEPSS 0.5%CVE-2010-10010LOWStars Alliance PsychoStats login.php cross site scriptingEPSS 0.5%CVE-2020-29027MEDIUMReflected Cross Site ScriptingEPSS 0.5%CVE-2025-7632HIGHStored XSSEPSS 0.5%CVE-2024-7685MEDIUMSourceCodester Kortex Lite Advocate Office Management System adds.php cross site scriptingEPSS 0.5%CVE-2014-125089LOWcention-chatserver InternalChatProtocol.fe _formatBody cross site scriptingEPSS 0.5%CVE-2024-4268MEDIUMUltimate Blocks – WordPress Blocks Plugin <= 3.1.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Multiple BlocksEPSS 0.5%CVE-2024-3762LOWEmlog Pro Whisper Page twitter.php cross site scriptingEPSS 0.5%CVE-2022-42991MEDIUMA stored cross-site scripting (XSS) vulnerability in Simple Online Public Access Catalog v1.0 allows attackers to execute arbitrary web scriEPSS 0.5%CVE-2025-0530MEDIUMcode-projects Job Recruitment _feedback_system.php cross site scriptingEPSS 0.5%CVE-2024-23896HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.5%CVE-2022-42206MEDIUMPHPGurukul Hospital Management System In PHP V 4.0 is vulnerable to Cross Site Scripting (XSS) via doctor/view-patient.php, admin/view-patieEPSS 0.5%CVE-2025-7430HIGHStored XSSEPSS 0.5%CVE-2024-2198MEDIUMContact Form by BestWebSoft <= 4.2.8 - Reflected Cross-Site Scripting via cntctfrm_contact_addressEPSS 0.5%