Weaknesses of type CWE-79

29,608 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-41513MEDIUMA reflected cross-site scripting (XSS) vulnerability in "Artikel.aspx" in CADClick v1.11.0 and before allows remote attackers to inject arbiEPSS 0.4%CVE-2018-11449—A vulnerability has been identified in SCALANCE M875 (All versions). An attacker with access to the local file system might obtain passwordsEPSS 0.4%CVE-2026-108834MEDIUMCairo-dock Glx-Dock Query Parameter ww_page.php cross site scriptingEPSS 0.4%CVE-2024-47067MEDIUMAlist Contains a Reflected Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2024-51091MEDIUMCross Site Scripting vulnerability in seajs v.2.2.3 allows a remote attacker to execute arbitrary code via the seajs packageEPSS 0.4%CVE-2023-27089HIGHCross Site Scripting vulnerability found in Ehuacui BBS allows attackers to cause a denial of service via a crafted payload in the login parEPSS 0.4%CVE-2024-1463MEDIUMLearnPress <= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-41515MEDIUMA reflected cross-site scripting (XSS) vulnerability in "ccHandlerResource.ashx" in CADClick <= 1.11.0 allows remote attackers to inject arbEPSS 0.4%CVE-2024-1571MEDIUMWP Recipe Maker <= 9.2.1 - Authenticated Stored Cross-Site Scripting via Video EmbedEPSS 0.4%CVE-2022-43754LOWSUMA/UYUNI reflected cross site scripting in /rhn/audit/scap/Search.doEPSS 0.4%CVE-2023-4773MEDIUMWordPress Social Login <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-38506HIGHCross-site Scripting (XSS) when pasting HTML into the rich text editor in JoplinEPSS 0.4%CVE-2022-39020HIGHCross-site scripting in Schoolbox version 21.0.2, by Schoolbox Pty LtdEPSS 0.4%CVE-2024-46209MEDIUMA stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrEPSS 0.4%CVE-2026-3907MEDIUMHostel <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wphostel-book' ShortcodeEPSS 0.4%CVE-2024-41516MEDIUMA Reflected cross-site scripting (XSS) vulnerability in "ccHandler.aspx" CADClick <= 1.11.0 allows remote attackers to inject arbitrary web EPSS 0.4%CVE-2022-42119MEDIUMCertain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4EPSS 0.4%CVE-2023-30435HIGHIBM Security Guardium cross-site scriptingEPSS 0.4%CVE-2024-24907HIGHDell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in the Filters page. EPSS 0.4%CVE-2025-2583MEDIUMSimpleMachines SMF ManageNews.php cross site scriptingEPSS 0.4%