Weaknesses of type CWE-79

29,274 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-42202MEDIUMTP-Link TL-WR841N 8.0 4.17.16 Build 120201 Rel.54750n is vulnerable to Cross Site Scripting (XSS).EPSS 0.5%CVE-2023-32072MEDIUMTuleap vulnerable toXSS via the triggered job URL of a Jenkins jobEPSS 0.5%CVE-2024-5137MEDIUMPHPGurukul Directory Management System Searchbar admin-profile.php cross site scriptingEPSS 0.5%CVE-2014-125088LOWqt-users-jp silk header.qml cross site scriptingEPSS 0.5%CVE-2024-5136MEDIUMPHPGurukul Directory Management System search-directory.php. cross site scriptingEPSS 0.5%CVE-2024-26075MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2023-28499—WordPress Slide Anything Plugin <= 2.4.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2023-2427MEDIUMCross-site Scripting (XSS) - Reflected in thorsten/phpmyfaqEPSS 0.5%CVE-2023-3014LOWBeipyVideoResolution admincore.php cross site scriptingEPSS 0.5%CVE-2022-2839—Zephyr Project Manager < 3.2.55 - Unauthorised AJAX Calls To Stored XSSEPSS 0.5%CVE-2026-26377MEDIUMCross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via the News function.EPSS 0.5%CVE-2022-35632—XSS in User InterfaceEPSS 0.5%CVE-2024-12581MEDIUMKadence Blocks <= 3.2.53 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2026-55085CRITICALEtherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-liteEPSS 0.5%CVE-2023-33761MEDIUMeMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the compoEPSS 0.5%CVE-2023-20120MEDIUMCisco Secure Email Gateway, Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance Cross-Site Scripting VulnerabilitiesEPSS 0.5%CVE-2024-6170MEDIUMUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'email'EPSS 0.5%CVE-2023-25592HIGHReflected Cross Site Scripting Vulnerabilities (XSS) in ClearPass Policy Manager Web-Based Management InterfaceEPSS 0.5%CVE-2023-25593HIGHReflected Cross Site Scripting Vulnerabilities (XSS) in ClearPass Policy Manager Web-Based Management InterfaceEPSS 0.5%CVE-2023-20028MEDIUMCisco Secure Email Gateway, Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance Cross-Site Scripting VulnerabilitiesEPSS 0.5%