Weaknesses of type CWE-79

29,276 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-4655MEDIUMCross-site Scripting (XSS) - Reflected in instantsoft/icms2EPSS 0.5%CVE-2019-18265MEDIUMDigital Alert Systems’ DASDEC software prior to version 4.1 contains a cross-site scripting (XSS) vulnerability that allows remote attackersEPSS 0.5%CVE-2022-43996MEDIUMThe csaf_provider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html. The endpoint upload allows valid CSAF aEPSS 0.5%CVE-2026-19716MEDIUMStored Cross-site Scripting in Pentestify user account deletion via unescaped usernameEPSS 0.5%CVE-2022-35722MEDIUMIBM Jazz for Service Management is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript EPSS 0.5%CVE-2022-2510MEDIUMPotential XSS on Special:SearchCenterEPSS 0.5%CVE-2026-49867MEDIUMDataEase: Authenticated Stored XSS in DataEase Template Static ResourcesEPSS 0.5%CVE-2021-36905MEDIUMWordPress Quiz And Survey Master plugin <= 7.3.4 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.5%CVE-2024-25705MEDIUMCross site scripting issue in embed widgetEPSS 0.5%CVE-2023-7015MEDIUMFile Manager Pro <= 8.3.4 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2023-2560LOWjja8 NewBingGoGo cross site scriptingEPSS 0.5%CVE-2022-3073MEDIUMQuaonos Schema ST4 example templates prone to XSSEPSS 0.5%CVE-2024-8716MEDIUMXT Ajax Add To Cart for WooCommerce <= 1.1.2 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2024-1691MEDIUMOtter Blocks PRO <= 2.6.3 - Unauthenticated Stored Cross-Site Scripting via SVG UploadEPSS 0.5%CVE-2023-49976MEDIUMA cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a craEPSS 0.5%CVE-2026-3993MEDIUMitsourcecode Payroll Management System manage_employee_deductions.php cross site scriptingEPSS 0.5%CVE-2021-44200—Self cross-site scripting (XSS) was possible on devices pageEPSS 0.5%CVE-2024-3687LOWbihell Dice Comment cross site scriptingEPSS 0.5%CVE-2021-44202—Stored cross-site scripting (XSS) was possible in activity detailsEPSS 0.5%CVE-2017-20191LOWZimbra zm-admin-ajax Form Textbox Field Error XFormItem.js XFormItem.prototype.setError cross site scriptingEPSS 0.5%