Weaknesses of type CWE-79

29,284 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-23012MEDIUMCross Site Scripting (XSS) vulnerability in craigrodway classroombookings 2.6.4 allows attackers to execute arbitrary code or other unspecifEPSS 0.5%CVE-2024-28142MEDIUMStored cross site scriptingEPSS 0.5%CVE-2023-6890MEDIUMCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.5%CVE-2023-6889MEDIUMCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.5%CVE-2024-7301HIGHWordPress File Upload <= 4.24.8 - Unauthenticated Stored Cross-Site Scripting via SVG File UploadEPSS 0.5%CVE-2022-4541HIGHWordPress Visitors <= 1.0 - Unauthenticated Stored Cross-Site Scripting via HTTP HeaderEPSS 0.5%CVE-2023-5842MEDIUMCross-site Scripting (XSS) - Stored in dolibarr/dolibarrEPSS 0.5%CVE-2024-4646LOWCampcodes Complete Web-Based School Management System student_payment_details.php cross site scriptingEPSS 0.5%CVE-2026-30862CRITICALCritical Stored XSS & Privilege Escalation in AppsmithEPSS 0.5%CVE-2022-38550MEDIUMA stored cross-site scripting (XSS) vulnerability in the /weibo/list component of Jeesns v2.0.0 allows attackers to execute arbitrary web scEPSS 0.5%CVE-2023-41843HIGHA improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through EPSS 0.5%CVE-2015-10128LOWrt-prettyphoto Plugin rt-prettyphoto.php royal_prettyphoto_plugin_links cross site scriptingEPSS 0.5%CVE-2026-55791MEDIUMCraft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJsEPSS 0.5%CVE-2026-16145HIGHInvisible Anti-Spam & CAPTCHA <= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' ParameterEPSS 0.5%CVE-2024-2793HIGHVisual Website Collaboration, Feedback & Project Management – Atarim <= 3.30 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.5%CVE-2022-31688MEDIUMVMware Workspace ONE Assist prior to 22.10 contains a Reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitizEPSS 0.5%CVE-2022-2725LOWSourceCodester Company Website CMS add-blog.php cross site scriptingEPSS 0.5%CVE-2026-27020MEDIUMPhotobooth has a XSS vulnerability in user inputEPSS 0.5%CVE-2024-39307LOWCross-Site Scripting (XSS) vulnerability via crafted ebooks in KavitaEPSS 0.5%CVE-2025-7946MEDIUMPHPGurukul Apartment Visitors Management System HTTP POST Request search-visitor.php cross site scriptingEPSS 0.5%