Weaknesses of type CWE-79

29,508 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-38832HIGHStored cross-site scripting vulnerability (CVE-2024-38832)EPSS 0.4%CVE-2021-47689MEDIUMNagios XI < 5.8.0 Core Config Manager (CCM) XSS via Templates PagesEPSS 0.4%CVE-2024-41356MEDIUMphpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\firewall-zones\zones-edit-network.php.EPSS 0.4%CVE-2025-65754MEDIUMCross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a filEPSS 0.4%CVE-2024-42762MEDIUMA Stored Cross Site Scripting (XSS) vulnerability was found in "/history.php" in Kashipara Bus Ticket Reservation System v1.0, which allows EPSS 0.4%CVE-2024-3647MEDIUMPremium Addons for Elementor <= 4.10.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'arrow_style'EPSS 0.4%CVE-2024-31847MEDIUMAn issue was discovered in Italtel Embrace 1.6.4. A stored cross-site scripting (XSS) vulnerability allows authenticated and unauthenticatedEPSS 0.4%CVE-2022-47444HIGHWordPress ProfilePress Plugin <= 4.4.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-34343MEDIUMCross-site Scripting (XSS) in navigateTo if used after SSR in nuxtEPSS 0.4%CVE-2023-4829MEDIUMCross-site Scripting (XSS) - Stored in froxlor/froxlorEPSS 0.4%CVE-2021-27781MEDIUMHCL BigFix Mobile / Modern Client Management is vulnerable to stored cross-site scriptingEPSS 0.4%CVE-2023-1237LOWCross-site Scripting (XSS) - Stored in answerdev/answerEPSS 0.4%CVE-2026-32277HIGHConnect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List ViewEPSS 0.4%CVE-2022-50797MEDIUMStripe Green Downloads Wordpress Plugin 2.03 Persistent XSS via SettingsEPSS 0.4%CVE-2023-26146MEDIUMAll versions of the package ithewei/libhv are vulnerable to Cross-site Scripting (XSS) such that when a file with a name containing a maliciEPSS 0.4%CVE-2023-29854MEDIUMDirCMS 6.0.0 has a Cross Site Scripting (XSS) vulnerability in the foreground.EPSS 0.4%CVE-2024-25895MEDIUMA reflected cross-site scripting (XSS) vulnerability in ChurchCRM 5.5.0 allows remote attackers to inject arbitrary web script or HTML via tEPSS 0.4%CVE-2024-42763MEDIUMA Reflected Cross Site Scripting (XSS) vulnerability was found in the "/schedule.php" page of the Kashipara Bus Ticket Reservation System v1EPSS 0.4%CVE-2023-26788MEDIUMVeritas Appliance v4.1.0.1 is affected by Host Header Injection attacks. HTTP host header can be manipulated and cause the application to beEPSS 0.4%CVE-2023-31165MEDIUMImproper Neutralization of Input During Web Page GenerationEPSS 0.4%