Weaknesses of type CWE-79

29,338 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-34022HIGHWordPress Dynamic QR Code Generator Plugin <= 0.0.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2024-23034MEDIUMCross Site Scripting vulnerability in the input parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.EPSS 0.5%CVE-2026-32852MEDIUMMailEnable < 10.55 Reflected XSS via FreeBusy.aspx StartDate ParameterEPSS 0.5%CVE-2023-0410MEDIUMCross-site Scripting (XSS) - Generic in builderio/qwikEPSS 0.5%CVE-2015-10127LOWPlusCaptcha Plugin cross site scriptingEPSS 0.5%CVE-2026-58491CRITICALWarpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameterEPSS 0.5%CVE-2023-6148MEDIUMPossible XSS vulnerability in Jenkins Plugin for Qualys Policy ComplianceEPSS 0.5%CVE-2023-5084LOWCross-site Scripting (XSS) - Reflected in hestiacp/hestiacpEPSS 0.5%CVE-2024-12664MEDIUMruifang-tech Rebuild Project Task Comment cross site scriptingEPSS 0.5%CVE-2024-23032MEDIUMCross Site Scripting vulnerability in num parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.EPSS 0.5%CVE-2024-23387MEDIUMFusionPBX prior to 5.1.0 contains a cross-site scripting vulnerability. If this vulnerability is exploited by a remote authenticated attackeEPSS 0.5%CVE-2026-32851MEDIUMMailEnable < 10.55 Reflected XSS via FreeBusy.aspx StartDate ParameterEPSS 0.5%CVE-2023-34032HIGHWordPress bbPress Toolkit Plugin <= 1.0.12 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2026-32850MEDIUMMailEnable < 10.55 Reflected XSS via ManageShares.aspx SelectedIndex ParameterEPSS 0.5%CVE-2024-8717MEDIUMPDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip <= 2.3.32 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2023-23938MEDIUMCross-site Scripting (XSS) through the name of a color of select box values in tuleapEPSS 0.5%CVE-2023-25453HIGHWordPress WordPress Tables Plugin <= 1.3.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2022-4966LOWsequentech admin-console Election Description cross site scriptingEPSS 0.5%CVE-2024-9806MEDIUMCraig Rodway Classroombookings Room Page fields cross site scriptingEPSS 0.5%CVE-2023-0371MEDIUMEmbedSocial < 1.1.28 - Contributor+ Stored XSSEPSS 0.5%