Weaknesses of type CWE-79

29,486 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-28982MEDIUMA cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackeEPSS 0.4%CVE-2023-51652MEDIUMOWASP.AntiSamy mXSS when preserving commentsEPSS 0.4%CVE-2024-9611MEDIUMIncrease upload file size & Maximum Execution Time limit <= 2.0 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-8583MEDIUMSourceCodester Online Bank Management System Feedback mfeedback.php cross site scriptingEPSS 0.4%CVE-2024-8337MEDIUMSourceCodester Contact Manager with Export to VCF index.html cross site scriptingEPSS 0.4%CVE-2024-26278MEDIUM[20240705] - Core - XSS in com_fields default field valueEPSS 0.4%CVE-2026-35218HIGHBudibase: Stored XSS via unsanitized entity names rendered with {@html} in Builder Command PaletteEPSS 0.4%CVE-2021-4035LOWWocu Monitoring stored Cross-Site Scripting (XSS)EPSS 0.4%CVE-2024-7793MEDIUMSourceCodester Task Progress Tracker add-task.php cross site scriptingEPSS 0.4%CVE-2024-7948MEDIUMSourceCodester Accounts Manager App Update Account Page update-account.php cross site scriptingEPSS 0.4%CVE-2022-45755MEDIUMCross-site scripting (XSS) vulnerability in EyouCMS v1.6.0 allows attackers to execute arbitrary code via the home page description on the bEPSS 0.4%CVE-2024-7200MEDIUMSourceCodester Complaints Report Management System cross site scriptingEPSS 0.4%CVE-2024-8951MEDIUMSourceCodester Resort Reservation System manage_fee.php cross site scriptingEPSS 0.4%CVE-2024-7466MEDIUMPMWeb Web Application Firewall cross site scriptingEPSS 0.4%CVE-2024-7068MEDIUMSourceCodester Insurance Management System update_sub_category cross site scriptingEPSS 0.4%CVE-2025-7761MEDIUMReflected XSS in Lepszy BIPEPSS 0.4%CVE-2023-31757MEDIUMDedeCMS up to v5.7.108 is vulnerable to XSS in sys_info.php via parameters 'edit___cfg_powerby' and 'edit___cfg_beian'EPSS 0.4%CVE-2025-10794MEDIUMPHPGurukul Car Rental Project search.php cross site scriptingEPSS 0.4%CVE-2026-34989CRITICALCI4MS affected by Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.4%CVE-2024-7285MEDIUMSourceCodester Establishment Billing Management System cross site scriptingEPSS 0.4%