Weaknesses of type CWE-79

29,274 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-45033MEDIUMA cross-site scripting (XSS) vulnerability in Expense Tracker 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted paEPSS 0.5%CVE-2026-15596MEDIUMSourceCodester Class and Exam Timetabling System subject.php cross site scriptingEPSS 0.5%CVE-2026-90571MEDIUMExrick xmall Order Printing order-print.jsp cross site scriptingEPSS 0.5%CVE-2026-84695CRITICALBookStack before 26.05.4 Stored XSS via Drawing UploadEPSS 0.5%CVE-2023-28692MEDIUMWordPress WP Abstracts Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2026-13556MEDIUMitsourcecode Online Hotel Management System POST Request controller.php edit cross site scriptingEPSS 0.5%CVE-2026-90615MEDIUMSourceCodester Class and Exam Timetabling System subject1.php cross site scriptingEPSS 0.5%CVE-2026-87923MEDIUMRizwan17 inventory-management-system List DBOperation.php cross site scriptingEPSS 0.5%CVE-2022-45008MEDIUMOnline Leave Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /leave_systEPSS 0.5%CVE-2023-39683MEDIUMCross Site Scripting (XSS) vulnerability in EasyEmail v.4.12.2 and before allows a local attacker to execute arbitrary code via the user inpEPSS 0.5%CVE-2024-1510MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip ShortcodeEPSS 0.5%CVE-2022-44069MEDIUMZenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via the Nest library module.EPSS 0.5%CVE-2024-1084MEDIUMCross-site Scripting in the tag name pattern field in the tag protections UI in GitHub Enterprise Server allows a malicious website that reqEPSS 0.5%CVE-2023-6488MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-2042MEDIUMElementsKit Elementor addons <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion WidgetEPSS 0.5%CVE-2022-44073MEDIUMZenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via svg,Users & Contacts.EPSS 0.5%CVE-2024-22569MEDIUMStored Cross-Site Scripting (XSS) vulnerability in POSCMS v4.6.2, allows attackers to execute arbitrary code via a crafted payload to /indexEPSS 0.5%CVE-2024-57277MEDIUMInnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting (XSS) via SVG file upload.EPSS 0.5%CVE-2024-1236MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-13736MEDIUMPure Chat – Live Chat & More! <= 2.4 - Reflected Cross-Site Scripting via purechatWidgetName ParameterEPSS 0.5%