Weaknesses of type CWE-79

29,588 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-35094MEDIUMWordPress WP Matterport Shortcode Plugin <= 2.1.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-4067MEDIUMBus Ticket Booking with Seat Reservation <= 5.2.3 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-2184MEDIUMWP Responsive Tabs horizontal vertical and accordion Tabs <= 1.1.15 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-37257MEDIUMThe DataEase panel and dataset have a stored XSS vulnerabilityEPSS 0.4%CVE-2023-49971MEDIUMA cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a craEPSS 0.4%CVE-2023-2289MEDIUMwordpress vertical image slider plugin <= 1.2.16 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-33231MEDIUMCross Site Scripting vulnerability in Ferozo Email version 1.1 allows a local attacker to execute arbitrary code via a crafted payload to thEPSS 0.4%CVE-2023-20145MEDIUMCisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesEPSS 0.4%CVE-2023-2402MEDIUMPhoto Gallery Slideshow & Masonry Tiled Gallery <= 1.0.13 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2022-40209MEDIUMWP Smart Import plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-44953MEDIUMwebtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /linkedcontent/listfiles.php. This vulEPSS 0.4%CVE-2023-20137MEDIUMCisco Small Business RV016, RV042, RV042G, RV082 , RV320, and RV325 Routers Cross-Site Scripting VulnerabilitiesEPSS 0.4%CVE-2025-0795MEDIUMESAFENET CDG todolistjump.jsp cross site scriptingEPSS 0.4%CVE-2025-1647MEDIUMXSS in Bootstrap title attribute for Tooltip and PopoverEPSS 0.4%CVE-2025-62702MEDIUMStored XSS through system messagesEPSS 0.4%CVE-2019-12703MEDIUMCisco SPA122 ATA with Router Devices DHCP Services Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2023-31801MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel parEPSS 0.4%CVE-2023-0486MEDIUMVitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance's administrator account via a malicious link. ThEPSS 0.4%CVE-2025-62695MEDIUMStored XSS through system messagesEPSS 0.4%CVE-2024-48246MEDIUMVehicle Management System 1.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the "Name" parameter of /vehicle-management/bookEPSS 0.4%