Weaknesses of type CWE-79

29,523 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-0566MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlorEPSS 0.4%CVE-2024-3956MEDIUMPods – Custom Content Types and Fields <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pod Form Redirect URLEPSS 0.4%CVE-2024-2475MEDIUMMedia Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery ShortcodeEPSS 0.4%CVE-2023-30563HIGHStored Cross-Site Scripting on User Import Functionality EPSS 0.4%CVE-2024-3974MEDIUMBuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-22610HIGHAngular has XSS Vulnerability via Unsanitized SVG Script AttributesEPSS 0.4%CVE-2023-47622HIGHiTop vulnerable to XSS vulnerability in dashlet refreshEPSS 0.4%CVE-2024-4822MEDIUMCross-site Scripting in School ERP Pro+Responsive by AROX SOLUTIONEPSS 0.4%CVE-2023-31156MEDIUMImproper Neutralization of Input During Web Page GenerationEPSS 0.4%CVE-2024-0792MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcodeEPSS 0.4%CVE-2024-30879MEDIUMReflected Cross Site Scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML aEPSS 0.4%CVE-2023-25836MEDIUMBUG-000135364 XSS in 10.8.1 sites builder iframe sourceEPSS 0.4%CVE-2025-6596NONEVector inserts portlet labels as HTML, allowing for stored XSS through system messagesEPSS 0.4%CVE-2023-31164MEDIUMImproper Neutralization of Input During Web Page GenerationEPSS 0.4%CVE-2022-45082LOWWordPress Accordions plugin <= 2.0.3 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.4%CVE-2023-31153MEDIUMImproper Neutralization of Input During Web Page GenerationEPSS 0.4%CVE-2023-31154MEDIUMImproper Neutralization of Input During Web Page GenerationEPSS 0.4%CVE-2024-1445MEDIUMPage scroll to id <= 1.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-1701MEDIUMCross-site Scripting (XSS) - Reflected in pimcore/pimcoreEPSS 0.4%CVE-2023-31159MEDIUMImproper Neutralization of Input During Web Page GenerationEPSS 0.4%