Weaknesses of type CWE-79

29,275 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-36905MEDIUMWordPress Quiz And Survey Master plugin <= 7.3.4 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.5%CVE-2023-1724HIGHFaveo Helpdesk Enterprise 6.0.1 - Privilege Escalation via Stored XSSEPSS 0.5%CVE-2026-18756HIGHHumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button renderingEPSS 0.5%CVE-2022-2511MEDIUMPotential XSS in title URL parameterEPSS 0.5%CVE-2022-2510MEDIUMPotential XSS on Special:SearchCenterEPSS 0.5%CVE-2023-3073MEDIUMCross-site Scripting (XSS) - Stored in tsolucio/corebosEPSS 0.5%CVE-2023-28687HIGHReflected Cross-Site Scripting (XSS) vulnerability in multiple WordPress themesEPSS 0.5%CVE-2026-84739HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.5%CVE-2023-4655MEDIUMCross-site Scripting (XSS) - Reflected in instantsoft/icms2EPSS 0.5%CVE-2022-43996MEDIUMThe csaf_provider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html. The endpoint upload allows valid CSAF aEPSS 0.5%CVE-2026-49391MEDIUMFrappe: Stored XSS in Column Headers via Data ImportEPSS 0.5%CVE-2024-41656HIGHSentry vulnerable to stored Cross-Site Scripting (XSS)EPSS 0.5%CVE-2024-11676MEDIUMCodeAstro Hospital Management System Add Laboratory Equipment Page his_admin_add_lab_equipment.php cross site scriptingEPSS 0.5%CVE-2024-2247HIGHJFrog Artifactory Cross-Site ScriptingEPSS 0.5%CVE-2026-55647MEDIUMDataEase: authenticated stored XSS in the dashboard text componentsEPSS 0.5%CVE-2024-33103MEDIUMAn arbitrary file upload vulnerability in the Media Manager component of DokuWiki 2024-02-06a allows attackers to execute arbitrary code by EPSS 0.5%CVE-2026-19434MEDIUMStored Cross-site Scripting in Pentestify finding severity fieldEPSS 0.5%CVE-2026-47348MEDIUMTYPO3 CMS - Cross-Site Scripting in Indexed SearchEPSS 0.5%CVE-2022-35722MEDIUMIBM Jazz for Service Management is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript EPSS 0.5%CVE-2026-28141HIGHWordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.5%