Weaknesses of type CWE-79

29,345 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-14691MEDIUMMayan EDMS authentication cross site scriptingEPSS 0.5%CVE-2023-43716MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2023-43734MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2024-10419MEDIUMcode-projects Blood Bank Management System bloodrequest.php cross site scriptingEPSS 0.5%CVE-2024-9356MEDIUMYotpo: Product & Photo Reviews for WooCommerce <= 1.7.9 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2022-29610—SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete (theme) data, which could resultEPSS 0.5%CVE-2023-38582MEDIUMSocomec MOD3GP-SY-120K Cross-site ScriptingEPSS 0.5%CVE-2023-0021MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaverEPSS 0.5%CVE-2023-43723MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2023-43709MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2025-55170MEDIUMWeGIA reflected XSS via `verificacao` and `redir_config` param at endpoint `/html/alterar_senha.php`EPSS 0.5%CVE-2023-43708MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2023-31406MEDIUMCross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence PlatformEPSS 0.5%CVE-2024-9092MEDIUMSourceCodester Profile Registration without Reload Refresh Registration Form add.php cross site scriptingEPSS 0.5%CVE-2026-30587MEDIUMMultiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro,EPSS 0.5%CVE-2023-43729MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2023-43728MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2023-43707MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2023-43727MEDIUMOs Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)EPSS 0.5%CVE-2024-10878MEDIUMSugar Calendar (Lite) <= 3.3.0 - Reflected Cross-Site ScriptingEPSS 0.5%