Weaknesses of type CWE-79

29,611 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2020-36861MEDIUMNagios XI < 5.7.5 Core Config Manager (CCM) XSS via Overlay Rendering and Notification/Check Period PagesEPSS 0.4%CVE-2021-47690MEDIUMNagios XI < 5.8.2 Core Config Manager (CCM) XSS via Overlay ModalsEPSS 0.4%CVE-2022-50584MEDIUMNagios XI < 5.8.8 Core Config Manager (CCM) XSS via Search & Deletion FlowsEPSS 0.4%CVE-2024-4636MEDIUMImage Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF <= 3.12.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG UploadEPSS 0.4%CVE-2020-36865MEDIUMNagios XI < 5.7.2 XSS via BPI Config ManagementEPSS 0.4%CVE-2022-39187MEDIUMRumpus - FTP server Reflected cross-site scripting (RXSS)EPSS 0.4%CVE-2016-15051MEDIUMNagios XI < 5.2.4 XSS via Report startdate/enddate FieldsEPSS 0.4%CVE-2023-6452CRITICALImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Web Security (Transaction VEPSS 0.4%CVE-2026-26719MEDIUMCross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET requesEPSS 0.4%CVE-2025-11183MEDIUMCross-Site Scripting Vulnerability in QWC2EPSS 0.4%CVE-2024-2278MEDIUMWooCommerce Product Filter < 1.4.4 - Admin+ Stored XSSEPSS 0.4%CVE-2023-26577HIGHStored Cross-site Scripting In IDAttend’s IDWeb ApplicationEPSS 0.4%CVE-2011-10039MEDIUMNagios XI < 2011R1.9 XSS via Alert Heatmap Report & “My Reports” ListingEPSS 0.4%CVE-2024-45932HIGHKrayin CRM v1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in /admin/contacts/organizations/edit/2.EPSS 0.4%CVE-2024-1993MEDIUMIcon Widget <= 1.3.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcodeEPSS 0.4%CVE-2025-53093HIGHTabberNeue vulnerable to Stored XSS through wikitextEPSS 0.4%CVE-2023-38214MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2021-46681MEDIUMVulnerability XSS in module mass operation name fieldEPSS 0.4%CVE-2023-38215MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.4%CVE-2020-36860MEDIUMNagios XI < 5.7.4 Core Config Manager (CCM) XSS via Object Edit PagesEPSS 0.4%