Weaknesses of type CWE-79

29,495 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-11366MEDIUMSEO Landing Page Generator <= 1.66.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-4892MEDIUMTeedy v1.11 - Stored cross-site scripting (XSS)EPSS 0.4%CVE-2022-40963MEDIUMWordPress WP Page Builder plugin <= 1.2.6 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.4%CVE-2024-57427MEDIUMPHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting (XSS). Multiple endpoints improperly handle user inputEPSS 0.4%CVE-2026-46686HIGHEmlog Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-6953MEDIUMMultiple vulnerabilities in Intermark IT's WebControl CMSEPSS 0.4%CVE-2024-48743MEDIUMCross Site Scripting vulnerability in Sentry v.6.0.9 allows a remote attacker to execute arbitrary code via the z parameter.EPSS 0.4%CVE-2022-45214MEDIUMA cross-site scripting (XSS) vulnerability in Sanitization Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTMEPSS 0.4%CVE-2021-31739MEDIUMThe SEPPmail solution is vulnerable to a Cross-Site Scripting vulnerability (XSS), because user input is not correctly encoded in HTML attriEPSS 0.4%CVE-2026-73157LOWcti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event MetadataEPSS 0.4%CVE-2023-0538—Campaign URL Builder < 1.8.2 - Contributor+ Stored XSSEPSS 0.4%CVE-2023-1356HIGHReflected Cross-site Scripting In IDAttend’s IDWeb ApplicationEPSS 0.4%CVE-2023-47554MEDIUMWordPress Actueel Financieel Nieuws – Denk Internet Solutions Plugin <= 5.1.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-49864HIGHwetty vulnerable to DOM XSS via file-download filenameEPSS 0.4%CVE-2026-54759HIGHSiYuan: Lute HTML sanitizer allows `<iframe>` tags in Bazaar package README, leading to arbitrary command execution via SiYuan Electron clientEPSS 0.4%CVE-2026-66824CRITICALStored Cross-Site Scripting via Unsafe Capture Tree JSON EmbeddingEPSS 0.4%CVE-2022-43142MEDIUMA cross-site scripting (XSS) vulnerability in the add-fee.php component of Password Storage Application v1.0 allows attackers to execute arbEPSS 0.4%CVE-2023-0280MEDIUMUltimate Carousel For Elementor <= 2.1.7 - Contributor+ Stored XSSEPSS 0.4%CVE-2021-47837MEDIUMMarkdownify 1.2.0 - Persistent Cross-Site ScriptingEPSS 0.4%CVE-2022-50586MEDIUMNagios XI < 5.8.9 Stored XSS via BPI Info URLEPSS 0.4%