Weaknesses of type CWE-79

29,621 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-54347HIGHFroxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account TakeoverEPSS 0.4%CVE-2019-25375MEDIUMOPNsense 19.1 Reflected XSS via monit interfaceEPSS 0.4%CVE-2023-47815MEDIUMWordPress BP Profile Shortcodes Extra Plugin <= 2.5.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-73329CRITICALCamaleonCMS Stored XSS via Draft Post Title Creation EndpointEPSS 0.4%CVE-2025-46872MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2024-45803MEDIUMCross site scripting (XSS) Vulnerability on route /wireui/button?label=Content in wireuiEPSS 0.4%CVE-2024-37680MEDIUMHangzhou Meisoft Information Technology Co., Ltd. FineSoft <=8.0 is affected by Cross Site Scripting (XSS) which allows remote attackers to EPSS 0.4%CVE-2023-44396MEDIUMiTop vulnerable to XSS in dashlet modifications ajax endpointsEPSS 0.4%CVE-2024-13660MEDIUMResponsive Flickr Slideshow <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-9383MEDIUMParcel Pro <= 1.8.4 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-55124MEDIUMImproper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script.EPSS 0.4%CVE-2023-46174MEDIUMIBM InfoSphere Information Server cross-site scriptingEPSS 0.4%CVE-2026-2545MEDIUMLigeroSmart index.pl cross site scriptingEPSS 0.4%CVE-2025-23210MEDIUMBypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheetEPSS 0.4%CVE-2024-32335MEDIUMTOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in Access Control under the Wireless Page.EPSS 0.4%CVE-2023-1312MEDIUMCross-site Scripting (XSS) - Reflected in pimcore/pimcoreEPSS 0.4%CVE-2026-32275HIGHTautulli: Unsanitized JSONP callback parameter allows cross-origin script injection and API key theftEPSS 0.4%CVE-2021-46871MEDIUMtag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes.EPSS 0.4%CVE-2024-57529MEDIUMCross Site Scripting vulnerability in Jeppesen JetPlanner Pro v.1.6.2.20 allows a remote attacker to execute arbitrary code.EPSS 0.4%CVE-2026-4544MEDIUMWavlink WL-WN578W2 POST Request login.cgi cross site scriptingEPSS 0.4%