Weaknesses of type CWE-79

29,613 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-31805MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local authenticated attacker to execute arbitrary code via the hoEPSS 0.4%CVE-2024-54442MEDIUMWordPress Better WP Login Page plugin <= 1.1.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-11291MEDIUMixmaps website2017 HTTP GET Request map.php cross site scriptingEPSS 0.4%CVE-2024-7787MEDIUMReflected XSS in ITG Computer Technology's vSRM Supplier Relationship Management SystemEPSS 0.4%CVE-2024-50990MEDIUMA Reflected Cross Site Scriptng (XSS) vulnerability was found in /omrs/user/search.php in PHPGurukul Online Marriage Registration System v1.EPSS 0.4%CVE-2024-12441MEDIUMBP Email Assign Templates <= 1.5 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2022-2507MEDIUMIn affected versions of Octopus Deploy it is possible to render user supplied input into the webpageEPSS 0.4%CVE-2024-9856MEDIUM07FLYCMS/07FLY-CMS/07FlyCRM System Settings Page cross site scriptingEPSS 0.4%CVE-2025-8211MEDIUMRoothub SystemConfigAdminController.java edit cross site scriptingEPSS 0.4%CVE-2024-12162MEDIUMVideo & Photo Gallery for Ultimate Member <= 1.1.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-27676MEDIUMVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross-Site Scripting in Reports V-2EPSS 0.4%CVE-2025-0961MEDIUMcode-projects Job Recruitment load_job-details.php cross site scriptingEPSS 0.4%CVE-2025-58064LOWCKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard packageEPSS 0.4%CVE-2023-31799MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the system annnounceEPSS 0.4%CVE-2023-31800MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the forum title paraEPSS 0.4%CVE-2022-47602MEDIUMWordPress WP Table Manager Plugin <= 3.5.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-2121MEDIUMVault’s KV Diff Viewer Allowed for HTML InjectionEPSS 0.4%CVE-2023-31806MEDIUMCross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload toEPSS 0.4%CVE-2024-10414MEDIUMPHPGurukul Vehicle Record System edit-brand.php cross site scriptingEPSS 0.4%CVE-2024-32469HIGHDecidim has cross-site scripting (XSS) in the paginationEPSS 0.4%