Weaknesses of type CWE-79

30,669 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-46073MEDIUMHelmet Store Showroom 1.0 is vulnerable to Cross Site Scripting (XSS).EPSS 1.3%CVE-2025-5366HIGHStored XSSEPSS 1.3%CVE-2025-5966HIGHStored XSSEPSS 1.3%CVE-2023-6134MEDIUMKeycloak: reflected xss via wildcard in oidc redirect_uriEPSS 1.3%CVE-2021-33851—A cross-site scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user's browser and can use an application as the vehicEPSS 1.3%CVE-2021-37695HIGHExecution of JavaScript code using malformed HTML in ckeditorEPSS 1.3%CVE-2023-37988HIGHWordPress Contact Form Generator Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS)EPSS 1.3%CVE-2021-43787CRITICALXSS via prototype pollutionEPSS 1.3%CVE-2020-15139HIGHXSS in MyBBEPSS 1.3%CVE-2024-28623MEDIUMRiteCMS v3.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component main_menu/edit_section.EPSS 1.3%CVE-2024-21328HIGHDynamics 365 Sales Spoofing VulnerabilityEPSS 1.3%CVE-2016-3709—Possible cross-site scripting vulnerability in libxml after commit 960f0e2.EPSS 1.3%CVE-2022-0571MEDIUMCross-site Scripting (XSS) - Reflected in phoronix-test-suite/phoronix-test-suiteEPSS 1.3%CVE-2022-4092MEDIUMAn issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. It was possible to create a malicious REAEPSS 1.3%CVE-2023-29183HIGHAn improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7.2.0 through 7EPSS 1.3%CVE-2024-31868MEDIUMApache Zeppelin: XSS vulnerability in the helium moduleEPSS 1.3%CVE-2024-20719CRITICAL[Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297EPSS 1.3%CVE-2024-27743MEDIUMCross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payloaEPSS 1.3%CVE-2018-3717—connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.jEPSS 1.3%CVE-2026-55549MEDIUMYamcs: Reflected XSS in the URL of the Authorize EndpointEPSS 1.3%