Weaknesses of type CWE-79

29,533 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-37750MEDIUMA reflected Cross-Site Scripting (XSS) vulnerability in School Management System by mahmoudai1 allows unauthenticated remote attackers to exEPSS 0.4%CVE-2024-10198MEDIUMcode-projects Pharmacy Management System Manage Customer Page manage_customer.php cross site scriptingEPSS 0.4%CVE-2026-48550MEDIUMNagios Core / XI cmd.cgi Reflected XSS via NagFormId ParameterEPSS 0.4%CVE-2022-42460MEDIUMWordPress Traffic Manager plugin <= 1.4.5 - Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS)EPSS 0.4%CVE-2024-3766LOWslowlyo OwlAdmin Image File Upload upload_image cross site scriptingEPSS 0.4%CVE-2024-9906MEDIUMSourceCodester Online Eyewear Shop cross site scriptingEPSS 0.4%CVE-2024-8792MEDIUMSubscribe to Comments <= 2.3 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-26022HIGHGogs: Stored XSS via data URI in issue commentsEPSS 0.4%CVE-2024-10842MEDIUMromadebrian WEB-Sekolah Backend Proses_Edit_Akun.php cross site scriptingEPSS 0.4%CVE-2026-11390MEDIUMNews Kit Addons For Elementor <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Logo Title and Single Author Box WidgetsEPSS 0.4%CVE-2024-9805MEDIUMcode-projects Blood Bank System campsdetails.php cross site scriptingEPSS 0.4%CVE-2026-74998HIGHIn Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which mEPSS 0.4%CVE-2024-25208MEDIUMBarangay Population Monitoring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Add Resident functionEPSS 0.4%CVE-2025-5062MEDIUMWooCommerce <= 9.4.2 - PostMessage-Based Cross-Site ScriptingEPSS 0.4%CVE-2024-9320MEDIUMSourceCodester Online Timesheet App Add Timesheet Form add-timesheet.php cross site scriptingEPSS 0.4%CVE-2024-7309MEDIUMSourceCodester Record Management System entry.php cross site scriptingEPSS 0.4%CVE-2024-9084MEDIUMcode-projects Blood Bank System bbms.php cross site scriptingEPSS 0.4%CVE-2024-10806MEDIUMPHPGurukul Hospital Management System betweendates-detailsreports.php cross site scriptingEPSS 0.4%CVE-2023-30743HIGHImproper Neutralization of Input in SAPUI5EPSS 0.4%CVE-2023-46071HIGHWordPress Protección de Datos RGPD Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%