Weaknesses of type CWE-79

29,486 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-62508MEDIUMCitizen vulnerable to stored XSS in sticky header button messagesEPSS 0.4%CVE-2024-53988LOWPossible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0EPSS 0.4%CVE-2022-28982MEDIUMA cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackeEPSS 0.4%CVE-2024-8583MEDIUMSourceCodester Online Bank Management System Feedback mfeedback.php cross site scriptingEPSS 0.4%CVE-2024-26278MEDIUM[20240705] - Core - XSS in com_fields default field valueEPSS 0.4%CVE-2024-7200MEDIUMSourceCodester Complaints Report Management System cross site scriptingEPSS 0.4%CVE-2024-7739MEDIUMyzane vscode-markdown-pdf cross site scriptingEPSS 0.4%CVE-2024-8951MEDIUMSourceCodester Resort Reservation System manage_fee.php cross site scriptingEPSS 0.4%CVE-2024-9611MEDIUMIncrease upload file size & Maximum Execution Time limit <= 2.0 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-28070MEDIUMA vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to EPSS 0.4%CVE-2026-35218HIGHBudibase: Stored XSS via unsanitized entity names rendered with {@html} in Builder Command PaletteEPSS 0.4%CVE-2022-45755MEDIUMCross-site scripting (XSS) vulnerability in EyouCMS v1.6.0 allows attackers to execute arbitrary code via the home page description on the bEPSS 0.4%CVE-2024-7793MEDIUMSourceCodester Task Progress Tracker add-task.php cross site scriptingEPSS 0.4%CVE-2024-7466MEDIUMPMWeb Web Application Firewall cross site scriptingEPSS 0.4%CVE-2022-41319MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability affects the Veritas Desktop Laptop Option (DLO) application login page (aka the DLOServEPSS 0.4%CVE-2021-4035LOWWocu Monitoring stored Cross-Site Scripting (XSS)EPSS 0.4%CVE-2023-51652MEDIUMOWASP.AntiSamy mXSS when preserving commentsEPSS 0.4%CVE-2024-8337MEDIUMSourceCodester Contact Manager with Export to VCF index.html cross site scriptingEPSS 0.4%CVE-2024-7068MEDIUMSourceCodester Insurance Management System update_sub_category cross site scriptingEPSS 0.4%CVE-2024-7948MEDIUMSourceCodester Accounts Manager App Update Account Page update-account.php cross site scriptingEPSS 0.4%