Weaknesses of type CWE-79

29,273 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-44301MEDIUM Dell DM5500 5.14.0.0 and prior contain a Reflected Cross-Site Scripting Vulnerability. A network attacker with low privileges could potenEPSS 0.5%CVE-2026-3812MEDIUMitsourcecode Payroll Management System manage_employee_allowances.php cross site scriptingEPSS 0.5%CVE-2025-31128MEDIUMgifplayer XSS vulnerabilityEPSS 0.5%CVE-2024-41240MEDIUMA Reflected Cross Site Scripting (XSS) vulnerability was found in " /smsa/teacher_login.php" in Kashipara Responsive School Management SysteEPSS 0.5%CVE-2024-31013MEDIUMCross Site Scripting (XSS) vulnerability in emlog version Pro 2.3, allow remote attackers to execute arbitrary code via a crafted payload toEPSS 0.5%CVE-2023-3051MEDIUMPage Builder by AZEXO <= 1.27.133 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2023-1875MEDIUMCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.5%CVE-2021-22722—A CWE-79: Improper Neutralization of Input During Web Page Generation ('Stored Cross-site Scripting') vulnerability exists in EVlink City (EEPSS 0.5%CVE-2025-4862MEDIUMPHPGurukul Directory Management System searchdata.php cross site scriptingEPSS 0.5%CVE-2021-35227MEDIUMInsecure Web Configuration for RabbitMQ Management Plugin in SolarWinds ARMEPSS 0.5%CVE-2023-1761MEDIUMCross-site Scripting in thorsten/phpmyfaqEPSS 0.5%CVE-2024-0963MEDIUMCalculated Fields Form <= 1.2.52 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-31586MEDIUMA Cross Site Scripting (XSS) vulnerability exists in Computer Laboratory Management System version 1.0. This vulnerability allows a remote aEPSS 0.5%CVE-2023-1885MEDIUMCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.5%CVE-2023-0747MEDIUMCross-site Scripting (XSS) - Stored in btcpayserver/btcpayserverEPSS 0.5%CVE-2023-5319HIGHCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.5%CVE-2023-3652MEDIUMReflected XSS in Digital Ant E-Commerce SoftwareEPSS 0.5%CVE-2025-6947MEDIUMWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in SIP Proxy ConfigurationEPSS 0.5%CVE-2024-8407MEDIUMalwindoss akademy handlers.go cross site scriptingEPSS 0.5%CVE-2023-0879MEDIUMCross-site Scripting (XSS) - Stored in btcpayserver/btcpayserverEPSS 0.5%