Weaknesses of type CWE-79

29,486 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-9417MEDIUMcode-projects Employee Management System myprofileup.php cross site scriptingEPSS 0.4%CVE-2023-24516MEDIUMStored Cross Site Scripting - Special Days ModuleEPSS 0.4%CVE-2026-6559MEDIUMWavlink WL-WN579A3 login.cgi sub_401F80 cross site scriptingEPSS 0.4%CVE-2022-41643MEDIUMWordPress Accessibility plugin <= 1.0.3 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-20626MEDIUMCisco Prime Access Registrar Appliance Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2024-25109MEDIUMCross-Site Scripting in the extensions, settings, permissions and namespaces subpages of ManageWikiEPSS 0.4%CVE-2024-33328MEDIUMA cross-site scripting (XSS) vulnerability in the component main.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to execute arbitrary webEPSS 0.4%CVE-2023-5613MEDIUMSuper Testimonials <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-26688MEDIUMCross Site Scripting (XSS) vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the product_data paEPSS 0.4%CVE-2022-2266MEDIUMReflected XSS University Library Automation SystemEPSS 0.4%CVE-2024-36222MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2022-40698MEDIUMWordPress Quiz And Survey Master plugin <= 7.3.10 - Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-45557MEDIUMCross site scripting (XSS) vulnerability in Hundredrabbits Left 7.1.5 for MacOS allows attackers to execute arbitrary code via file names.EPSS 0.4%CVE-2022-45558MEDIUMCross site scripting (XSS) vulnerability in Hundredrabbits Left 7.1.5 for MacOS allows attackers to execute arbitrary code via the meta tag.EPSS 0.4%CVE-2025-62508MEDIUMCitizen vulnerable to stored XSS in sticky header button messagesEPSS 0.4%CVE-2024-41658MEDIUMGHSL-2024-036: Reflected XSS in QrCodePage.jsEPSS 0.4%CVE-2023-0677MEDIUMCross-site Scripting (XSS) - Reflected in phpipam/phpipamEPSS 0.4%CVE-2024-7453MEDIUMFastAdmin Attachment Management Section 4 cross site scriptingEPSS 0.4%CVE-2022-30615MEDIUM"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScriptEPSS 0.4%CVE-2026-28297MEDIUMSolarWinds Observability Self-Hosted Stored Cross-Site Scripting VulnerabilityEPSS 0.4%