Weaknesses of type CWE-79

29,288 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-37781MEDIUMEmployee Record Management System v 1.2 is vulnerable to Cross Site Scripting (XSS) via editempprofile.php.EPSS 0.5%CVE-2023-44309CRITICALMultiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay EPSS 0.5%CVE-2023-22638MEDIUMSeveral improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9EPSS 0.5%CVE-2025-22272LOWSelf Reflected XSS in CyberArk Endpoint Privilege ManagerEPSS 0.5%CVE-2022-2748LOWSourceCodester Simple Online Book Store System edit.php cross site scriptingEPSS 0.5%CVE-2022-46058MEDIUMAeroCMS v0.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers toEPSS 0.5%CVE-2024-8714MEDIUMWordPress Affiliates Plugin — SliceWP Affiliates <= 1.1.20 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2026-34569CRITICALCI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.5%CVE-2023-44310CRITICALStored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 throEPSS 0.5%CVE-2026-25640HIGHPydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URLEPSS 0.5%CVE-2023-3122HIGHGD Mail Queue <= 3.9.3 - Unauthenticated Stored Cross-Site Scripting via EmailEPSS 0.5%CVE-2023-3088HIGHWP Mail Log <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting via EmailEPSS 0.5%CVE-2022-2645LOWSourceCodester Garage Management System edituser.php cross site scriptingEPSS 0.5%CVE-2024-9204MEDIUMSmart Custom 404 Error Page <= 11.4.7 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2024-3677MEDIUMUltimate 410 Gone Status Code <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2021-40121MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilitiesEPSS 0.5%CVE-2024-2786MEDIUMHappy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via title_tagEPSS 0.5%CVE-2024-10142MEDIUMcode-projects Blood Bank System viewrequest.php cross site scriptingEPSS 0.5%CVE-2024-3021MEDIUMMhr Post Ticker <= 1.1 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2026-86550MEDIUMUXSS vulnerability in ZTE browser productsEPSS 0.5%