Weaknesses of type CWE-79

29,368 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-1354MEDIUMA cross-site scripting (XSS) vulnerability in the RT-N10E/ RT-N12E 2.0.0.x firmware . This vulnerability caused by improper input validatioEPSS 0.5%CVE-2025-40701MEDIUMReflected Cross-Site scripting (XSS) in SOTE's SOTESHOPEPSS 0.5%CVE-2025-25189MEDIUM[XBOW-025-031] Reflected Cross-Site Scripting via jobid Parameter in ZOO-Project WPS publish.py CGI ScriptEPSS 0.5%CVE-2026-18324HIGHForminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea FieldEPSS 0.5%CVE-2026-42224HIGHipl/web is vulnerable to reflected XSS by malformed search requestsEPSS 0.5%CVE-2024-7677MEDIUMSourceCodester Car Driving School Management System SystemSettings.php update_settings_info cross site scriptingEPSS 0.5%CVE-2024-12180MEDIUMDedeCMS article_add.php cross site scriptingEPSS 0.5%CVE-2022-27561HIGHHCL Traveler is susceptible to a Reflected Cross-Site Scripting vulnerability in the web admin (LotusTraveler.nsf)EPSS 0.5%CVE-2024-12049MEDIUMWoo Ukrposhta <= 1.17.11 - Reflected Cross-Site Scripting via order, post, and idd ParametersEPSS 0.5%CVE-2024-55494MEDIUMA PHP Code Injection vulnerability that can lead to Remote Code Execution (RCE) and XSS in Opencode Mobile Collect Call v5.4.7 allows attackEPSS 0.5%CVE-2025-62380LOWMailgen has HTML Injection and XSS Filter Bypass in Plaintext EmailsEPSS 0.5%CVE-2026-102147CRITICALKiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)EPSS 0.5%CVE-2023-23372MEDIUMQTS, QuTS heroEPSS 0.5%CVE-2022-38758HIGHXSS vulnerabilities in iManagerEPSS 0.5%CVE-2026-8948CRITICALSame-origin policy bypass in the DOM: Networking componentEPSS 0.5%CVE-2024-7678MEDIUMSourceCodester Car Driving School Management System Master.php cross site scriptingEPSS 0.5%CVE-2023-6807MEDIUMGeneratePress Premium <= 2.3.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom MetaEPSS 0.5%CVE-2024-12262MEDIUMEbook Store <= 5.8001 - Reflected Cross-Site Scripting via 'step'EPSS 0.5%CVE-2024-57386MEDIUMCross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function.EPSS 0.5%CVE-2024-11427MEDIUMCatch Popup <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%