Weaknesses of type CWE-79

29,613 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-31802MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skype and linediEPSS 0.4%CVE-2025-31483MEDIUMStored XSS in Miniflux Media Proxy due to improper Content-Security-Policy configurationEPSS 0.4%CVE-2024-22491MEDIUMA Stored Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the post/save content parameteEPSS 0.4%CVE-2025-7840MEDIUMCampcodes Online Movie Theater Seat Reservation System Reserve Your Seat Page index.php cross site scriptingEPSS 0.4%CVE-2024-7835HIGHReflected XSS in Exnet Informatics Software's Ferry Reservation SystemEPSS 0.4%CVE-2017-20193MEDIUMProduct Vendors <= 2.0.35 - Reflected Cross Site ScriptingEPSS 0.4%CVE-2023-31807MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload toEPSS 0.4%CVE-2024-7873CRITICALStored XSS in Veribilim Software's Veribase Order ManagementEPSS 0.4%CVE-2023-31804MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the course category EPSS 0.4%CVE-2024-34467MEDIUMThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in think_exception.tpl.EPSS 0.4%CVE-2025-55522MEDIUMCross-site scripting (XSS) vulnerability in the component /common/reports of Akaunting v3.1.18 allows attackers to execute arbitrary web scrEPSS 0.4%CVE-2022-23466MEDIUMDOM-based cross-site scripting (XSS) in teler dashboardEPSS 0.4%CVE-2025-4075MEDIUMVMSMan login.php cross site scriptingEPSS 0.4%CVE-2022-47602MEDIUMWordPress WP Table Manager Plugin <= 3.5.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-27676MEDIUMVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross-Site Scripting in Reports V-2EPSS 0.4%CVE-2024-35582MEDIUMA cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scrEPSS 0.4%CVE-2024-55268MEDIUMA Reflected Cross Site Scripting (XSS) vulnerability was found in /covidtms/registered-user-testing.php in PHPGurukul COVID 19 Testing ManagEPSS 0.4%CVE-2023-31800MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the forum title paraEPSS 0.4%CVE-2024-10414MEDIUMPHPGurukul Vehicle Record System edit-brand.php cross site scriptingEPSS 0.4%CVE-2023-2121MEDIUMVault’s KV Diff Viewer Allowed for HTML InjectionEPSS 0.4%