Weaknesses of type CWE-79

29,583 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-50710MEDIUMFrappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_configEPSS 0.4%CVE-2023-26491MEDIUMRSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parametersEPSS 0.4%CVE-2024-9221MEDIUMTainacan <= 0.21.10 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-28662MEDIUMA Cross Site Scripting vulnerability exists in Piwigo before 14.3.0 script because of missing sanitization in create_tag in admin/include/fuEPSS 0.4%CVE-2026-44737MEDIUMgrav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][title]EPSS 0.4%CVE-2022-47983MEDIUMIBM InfoSphere Information Server cross-site scriptingEPSS 0.4%CVE-2026-50705MEDIUMFrappe Framework 17.0.0-dev - Stored XSS in Form Dashboard headline renderingEPSS 0.4%CVE-2023-38827MEDIUMCross Site Scripting vulnerability in Follet School Solutions Destiny v.20_0_1_AU4 and later allows a remote attacker to run arbitrary code EPSS 0.4%CVE-2024-9075LOWStirling-Tools Stirling-PDF Markdown-to-PDF cross site scriptingEPSS 0.4%CVE-2023-23015MEDIUMCross Site Scripting (XSS) vulnerability in Kalkun 0.8.0 via username input in file User_model.php.EPSS 0.4%CVE-2024-45625MEDIUMCross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script maEPSS 0.4%CVE-2024-1428MEDIUMElement Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) <= 5.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trailer Box WidgetEPSS 0.4%CVE-2024-23031MEDIUMCross Site Scripting (XSS) vulnerability in is_water parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via craftedEPSS 0.4%CVE-2024-27290MEDIUMDocassemble HTML and javascript injectionEPSS 0.4%CVE-2020-36826LOWAwesomestCode LiveBot parseMessage.js parseSend cross site scriptingEPSS 0.4%CVE-2023-41844LOWA improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through EPSS 0.4%CVE-2023-27092MEDIUMCross Site Scripting vulnerability found in Jbootfly allows attackers to obtain sensitive information via the username parameter.EPSS 0.4%CVE-2025-1957MEDIUMcode-projects Blood Bank System o+.php cross site scriptingEPSS 0.4%CVE-2024-34424MEDIUMWordPress Featured Content Gallery plugin <= 3.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2011-10006LOWGamerZ WP-PostRatings wp-postratings.php cross site scriptingEPSS 0.4%