Weaknesses of type CWE-79

28,562 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-23647HIGHCross-site Scripting in PrismEPSS 1.5%CVE-2022-43018MEDIUMOpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email fuEPSS 1.5%CVE-2022-43016MEDIUMOpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component.EPSS 1.5%CVE-2022-43670MEDIUMXSS in Sling CMS Reference App Taxonomy PathEPSS 1.5%CVE-2022-43017MEDIUMOpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component.EPSS 1.5%CVE-2023-2949HIGHCross-site Scripting (XSS) - Reflected in openemr/openemrEPSS 1.5%CVE-2018-3740—A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML elemeEPSS 1.5%CVE-2011-2927MEDIUMSpacewalk: spacewalk and red hat network satellite: cross-site scripting vulnerability via search formsEPSS 1.5%CVE-2011-3344MEDIUMSpacewalk: spacewalk: cross-site scripting via uri in lookup login/password formEPSS 1.5%CVE-2017-2285MEDIUMCross-site scripting vulnerability in Simple Custom CSS and JS prior to version 3.4 allows remote attackers to inject arbitrary web script oEPSS 1.5%CVE-2020-26287HIGHStored XSS in mermaid diagramsEPSS 1.5%CVE-2016-10531—marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specificallEPSS 1.5%CVE-2023-7173MEDIUMPHPGurukul Hospital Management System registration.php cross site scriptingEPSS 1.5%CVE-2017-2610MEDIUMjenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping userEPSS 1.5%CVE-2022-2187—Contact Form 7 Captcha < 0.1.2 - Reflected Cross-Site ScriptingEPSS 1.5%CVE-2022-0206—NewStatPress < 1.3.6 - Reflected Cross-Site ScriptingEPSS 1.5%CVE-2022-0257MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 1.5%CVE-2022-0285MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 1.5%CVE-2022-2473MEDIUMWP-UserOnline <= 2.87.6 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 1.5%CVE-2025-61224MEDIUMCross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitrary code via the q paEPSS 1.5%