Weaknesses of type CWE-79

28,581 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-0924HIGHWP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.4%CVE-2018-15436—Cisco Webex Centers Cross-Site Scripting VulnerabilityEPSS 1.4%CVE-2022-48012MEDIUMOpencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settiEPSS 1.4%CVE-2023-29808MEDIUMCross Site Scripting (XSS) vulnerability in vogtmh cmaps (companymaps) 8.0 allows attackers to execute arbitrary code.EPSS 1.4%CVE-2021-24213—GiveWP < 2.10.0 - Reflected Cross Site Scripting (XSS)EPSS 1.4%CVE-2025-1015MEDIUMUnsanitized address book fieldsEPSS 1.4%CVE-2024-10793HIGHWP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id ParameterEPSS 1.4%CVE-2020-26280HIGHXSS in OpenSlidesEPSS 1.4%CVE-2025-24158MEDIUMThe issue was addressed with improved memory handling. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3, tvOEPSS 1.4%CVE-2023-42034HIGHVisualware MyConnection Server doRTAAccessCTConfig Cross-Site Scripting Authentication Bypass VulnerabilityEPSS 1.4%CVE-2021-1245MEDIUMCisco Finesse OpenSocial Gadget Editor Cross-Site Scripting VulnerabilityEPSS 1.4%CVE-2019-25152HIGHAbandoned Cart Lite for WooCommerce < 5.2.0 and Abandoned Cart Pro for WooCommerce < 7.13.0 - Stored Cross-Site ScriptingEPSS 1.4%CVE-2022-0743MEDIUMCross-site Scripting (XSS) - Stored in getgrav/gravEPSS 1.4%CVE-2014-2370—Omron NS Series HMI Improper Neutralization of Input During Web Page GenerationEPSS 1.4%CVE-2022-2170—Microsoft Advertising Universal Event Tracking < 1.0.4 - Admin+ Stored Cross-Site ScriptingEPSS 1.4%CVE-2022-24833HIGHPersistent Cross-site Scripting (XSS) vulnerability in PrivateBinEPSS 1.4%CVE-2008-3937MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in Open Media Collectors Database (OpenDb) 1.0.6 allow remote attackers to inject arbitrEPSS 1.4%CVE-2017-16016—Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XEPSS 1.4%CVE-2022-2168—Download Manager < 3.2.44 - Reflected Cross-Site ScriptingEPSS 1.4%CVE-2020-8217—A cross site scripting (XSS) vulnerability in Pulse Connect Secure <9.1R8 allowed attackers to exploit in the URL used for Citrix ICA.EPSS 1.4%