Weaknesses of type CWE-79

29,486 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-4648LOWCampcodes Complete Web-Based School Management System student_exam_mark_update_form.php cross site scriptingEPSS 0.4%CVE-2022-48091MEDIUMTramyardg hotel-mgmt-system version 2022.4 is vulnerable to Cross Site Scripting (XSS) via process_update_profile.php.EPSS 0.4%CVE-2025-24854MEDIUMApache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image pluginEPSS 0.4%CVE-2023-1776HIGHStored XSS via SVG attachment on BoardsEPSS 0.4%CVE-2025-7761MEDIUMReflected XSS in Lepszy BIPEPSS 0.4%CVE-2024-30890MEDIUMCross Site Scripting vulnerability in ED01-CMS v.1.0 allows an attacker to obtain sensitive information via the categories.php component.EPSS 0.4%CVE-2025-9158MEDIUMStored XSS in Request TrackerEPSS 0.4%CVE-2024-5437MEDIUMSourceCodester Simple Online Bidding System save_category cross site scriptingEPSS 0.4%CVE-2023-24721MEDIUMA cross-site scripting (XSS) vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary web scripts or HTML.EPSS 0.4%CVE-2025-2205MEDIUMGDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-31757MEDIUMDedeCMS up to v5.7.108 is vulnerable to XSS in sys_info.php via parameters 'edit___cfg_powerby' and 'edit___cfg_beian'EPSS 0.4%CVE-2024-7285MEDIUMSourceCodester Establishment Billing Management System cross site scriptingEPSS 0.4%CVE-2024-6907MEDIUMSourceCodester Record Management System sort.php cross site scriptingEPSS 0.4%CVE-2023-1884MEDIUMCross-site Scripting (XSS) - Generic in thorsten/phpmyfaqEPSS 0.4%CVE-2026-34989CRITICALCI4MS affected by Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.4%CVE-2024-29191MEDIUMGHSL-2023-205 gotortc DOM-based Cross-site Scripting vulnerabilityEPSS 0.4%CVE-2022-0475LOWPossible XSS attack via translationEPSS 0.4%CVE-2024-26140MEDIUMcom.yetanalytics/lrs has Cross-site Scripting Vulnerability in Statement BrowserEPSS 0.4%CVE-2025-10794MEDIUMPHPGurukul Car Rental Project search.php cross site scriptingEPSS 0.4%CVE-2022-28980MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitraryEPSS 0.4%