Weaknesses of type CWE-79

29,349 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-23022MEDIUMCross site scripting (XSS) vulnerability in sourcecodester oretnom23 employee's payroll management system 1.0, allows attackers to execute aEPSS 0.5%CVE-2023-27151MEDIUMopenCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number (in the Saved Search Activity) vEPSS 0.5%CVE-2024-9184HIGHSendPulse Free Web Push <= 1.3.6 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.5%CVE-2026-1959MEDIUMStored Cross-Site Scripting (XSS) vulnerability in Loggro PymesEPSS 0.5%CVE-2025-5343MEDIUMStored XSSEPSS 0.5%CVE-2022-39372LOWStored Cross-Site Scripting (XSS) in user information in GLPIEPSS 0.5%CVE-2024-2275LOWBdtask G-Prescription Gynaecology & OBS Consultation Software OBS Patient/Gynee Prescription cross site scriptingEPSS 0.5%CVE-2024-10623MEDIUMForumEngine <= 1.8 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2023-23021MEDIUMCross Site Scripting (XSS) vulnerability in sourcecodester oretnom23 pos point sale system 1.0, allows attackers to execute arbitrary code vEPSS 0.5%CVE-2025-5347MEDIUMStored XSSEPSS 0.5%CVE-2025-27434HIGHCross-Site Scripting (XSS) vulnerability in SAP Commerce (Swagger UI)EPSS 0.5%CVE-2024-29220MEDIUMNinja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, anEPSS 0.5%CVE-2024-8739MEDIUMReCaptcha Integration for WordPress <= 1.2.5 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2024-1257LOWJspxcms find_text.do cross site scriptingEPSS 0.5%CVE-2023-3193MEDIUMCross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DEPSS 0.5%CVE-2026-1960MEDIUMStored Cross-Site Scripting (XSS) vulnerability in Loggro PymesEPSS 0.5%CVE-2023-45769HIGHWordPress WP Report Post Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2022-36311—Airspan AirVelocity 1500 prior to software version 15.18.00.2511 is vulnerable to injection leading to XSS in the SNMP community field in thEPSS 0.5%CVE-2025-3822MEDIUMSourceCodester Web-based Pharmacy Product Management System changepassword.php cross site scriptingEPSS 0.5%CVE-2024-7310MEDIUMSourceCodester Record Management System sort_user.php cross site scriptingEPSS 0.5%