Weaknesses of type CWE-79

29,278 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2017-20191LOWZimbra zm-admin-ajax Form Textbox Field Error XFormItem.js XFormItem.prototype.setError cross site scriptingEPSS 0.5%CVE-2024-8610MEDIUMSourceCodester Best House Rental Management System New Tenant Page index.php cross site scriptingEPSS 0.5%CVE-2023-7076LOWslawkens MyAAC bugtracker.php cross site scriptingEPSS 0.5%CVE-2023-49976MEDIUMA cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a craEPSS 0.5%CVE-2021-44202—Stored cross-site scripting (XSS) was possible in activity detailsEPSS 0.5%CVE-2024-9807MEDIUMCraig Rodway Classroombookings Session Page sessions cross site scriptingEPSS 0.5%CVE-2023-2560LOWjja8 NewBingGoGo cross site scriptingEPSS 0.5%CVE-2021-44200—Self cross-site scripting (XSS) was possible on devices pageEPSS 0.5%CVE-2021-44203—Stored cross-site scripting (XSS) was possible in protection plan detailsEPSS 0.5%CVE-2026-3990MEDIUMCesiumGS CesiumJS standalone.html cross site scriptingEPSS 0.5%CVE-2024-5424MEDIUMGallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via galleryID and className ParametersEPSS 0.5%CVE-2025-47933CRITICALArgo CD allows cross-site scripting on repositories pageEPSS 0.5%CVE-2024-13227MEDIUMRank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.235 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rank Math APIEPSS 0.5%CVE-2022-3073MEDIUMQuaonos Schema ST4 example templates prone to XSSEPSS 0.5%CVE-2026-3610MEDIUMHSC Cybersecurity Mailinspector URL mliUserValidation.php cross site scriptingEPSS 0.5%CVE-2026-3982MEDIUMitsourcecode University Management System view_result.php cross site scriptingEPSS 0.5%CVE-2024-1691MEDIUMOtter Blocks PRO <= 2.6.3 - Unauthenticated Stored Cross-Site Scripting via SVG UploadEPSS 0.5%CVE-2026-47631HIGHMicrosoft Exchange Server Spoofing VulnerabilityEPSS 0.5%CVE-2026-47646CRITICALDynamics 365 Customer Voice Spoofing VulnerabilityEPSS 0.5%CVE-2024-11247MEDIUMSourceCodester Online Eyewear Shop Inventory Page Master.php cross site scriptingEPSS 0.5%