Weaknesses of type CWE-79

29,250 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-49409CRITICALWordPress SensorPress plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2026-67237HIGHRabbitMQ: Reflected XSS via the OAuth bootstrap JS endpointEPSS 0.5%CVE-2025-9226MEDIUMStored XSSEPSS 0.5%CVE-2024-22199CRITICALDjango Template Engine Vulnerable to XSSEPSS 0.5%CVE-2020-36828LOWDiscuzX install_function.php show_next_step cross site scriptingEPSS 0.5%CVE-2020-15855—Two cross-site scripting vulnerabilities were fixed in Bodhi 5.6.1.EPSS 0.5%CVE-2022-20969MEDIUMA vulnerability in multiple management dashboard pages of Cisco Umbrella could allow an authenticated, remote attacker to conduct a cross-siEPSS 0.5%CVE-2024-50585MEDIUMReflected Cross-Site ScriptingEPSS 0.5%CVE-2016-15035LOWDoc2k RE-Chat re_chat.js cross site scriptingEPSS 0.5%CVE-2019-25105LOWdro.pm fileman.php cross site scriptingEPSS 0.5%CVE-2023-49984MEDIUMA cross-site scripting (XSS) vulnerability in the component /management/settings of School Fees Management System v1.0 allows attackers to eEPSS 0.5%CVE-2021-24431—Language Bar Flags <= 1.0.8 - CSRF to Stored XSSEPSS 0.5%CVE-2024-31973MEDIUMHitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via the 'NeEPSS 0.5%CVE-2024-2133LOWBdtask Isshue Multi Store eCommerce Shopping Cart Solution Manage Sale Page manage_invoice cross site scriptingEPSS 0.5%CVE-2025-64539CRITICALAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.5%CVE-2024-4201MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.5%CVE-2023-7314MEDIUMNagios XI < 5.11.3 XSS via Bandwidth ReportEPSS 0.5%CVE-2024-37297MEDIUMWooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration formsEPSS 0.5%CVE-2026-77850HIGHStored XSS in AshAdmin relationship typeahead via unescaped label_field contentEPSS 0.5%CVE-2024-53262LOWUnescaped error message included on error page in SvelteKitEPSS 0.5%