Weaknesses of type CWE-79

29,286 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-1277MEDIUMOcean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2023-3982MEDIUMCross-site Scripting (XSS) - Stored in omeka/omeka-sEPSS 0.5%CVE-2024-28722MEDIUMCross Site Scripting vulnerability in Innovaphone myPBX v.14r1, v.13r3, v.12r2 allows a remote attacker to execute arbitrary code via the quEPSS 0.5%CVE-2024-32562HIGHWordPress Z Y N I T H plugin <= 7.4.9 - Unauthenticated Cross Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2025-1967MEDIUMcode-projects Blood Bank Management System donor.php cross site scriptingEPSS 0.5%CVE-2021-36858MEDIUMWordPress Testimonials plugin <= 2.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2022-44586MEDIUMWordPress AM-HiLi plugin <= 1.0 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2025-56683CRITICALA cross-site scripting (XSS) vulnerability in the component /app/marketplace.html of Logseq v0.10.9 allows attackers to execute arbitrary coEPSS 0.5%CVE-2025-67289CRITICALAn arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execute arbitrary code viaEPSS 0.5%CVE-2026-27020MEDIUMPhotobooth has a XSS vulnerability in user inputEPSS 0.5%CVE-2024-27242MEDIUMZoom Desktop Client for Linux - Cross Site ScriptingEPSS 0.5%CVE-2022-43525MEDIUMMultiple vulnerabilities within the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow a remote attackeEPSS 0.5%CVE-2023-3136HIGHMailArchiver <= 2.10.1 - Unauthenticated Stored Cross-Site Scripting via Email SubjectEPSS 0.5%CVE-2022-1075LOWCollege Website Management System Contact cross site scriptingEPSS 0.5%CVE-2024-9033MEDIUMSourceCodester Best House Rental Management System ajax.php cross site scriptingEPSS 0.5%CVE-2026-3027MEDIUMerzhongxmu JEEWMS UEditor getContent.jsp cross site scriptingEPSS 0.5%CVE-2024-25695HIGHconcatenated errors resulting in cross site scripting and frame injection issues.EPSS 0.5%CVE-2026-34560CRITICALCI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.5%CVE-2022-43527MEDIUMMultiple vulnerabilities within the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow a remote attackeEPSS 0.5%CVE-2020-37019MEDIUMOrchard Core RC1 - Persistent Cross-Site ScriptingEPSS 0.5%