Weaknesses of type CWE-79

29,621 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-11116MEDIUMInappropriate implementation in Blink in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who convinced a user to engage in spEPSS 0.4%CVE-2023-6122MEDIUMReflected XSS in Softomi E-commerce SoftwareEPSS 0.4%CVE-2024-48654MEDIUMCross Site Scripting vulnerability in Blood Bank v.1 allows a remote attacker to execute arbitrary code via a crafted script to the login.phEPSS 0.4%CVE-2024-30618MEDIUMA Stored Cross-Site Scripting (XSS) Vulnerability in Chamilo LMS 1.11.26 allows a remote attacker to execute arbitrary JavaScript in a web bEPSS 0.4%CVE-2022-38195MEDIUMBUG-000150540 - Reflected XSS vulnerability in ArcGIS ServerEPSS 0.4%CVE-2026-23960HIGHArgo Workflows affected by stored XSS in the artifact directory listingEPSS 0.4%CVE-2024-9023MEDIUMWP-WebAuthn <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wwa_login_form ShortcodeEPSS 0.4%CVE-2023-29376MEDIUMAn issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, aEPSS 0.4%CVE-2023-40047HIGHWS_FTP Server Stored Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2023-49225MEDIUMA cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo). If this vulnerability isEPSS 0.4%CVE-2024-1396MEDIUMShortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag'EPSS 0.4%CVE-2023-46483MEDIUMCross Site Scripting vulnerability in timetec AWDMS v.2.0 allows an attacker to obtain sensitive information via a crafted payload to the reEPSS 0.4%CVE-2023-5867MEDIUMCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.4%CVE-2026-77028MEDIUMJoomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66EPSS 0.4%CVE-2018-25097LOWAcumos Design Studio cross site scriptingEPSS 0.4%CVE-2026-32196MEDIUMWindows Admin Center Spoofing VulnerabilityEPSS 0.4%CVE-2026-84665HIGHJenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scannerEPSS 0.4%CVE-2024-11997MEDIUMcode-projects Farmacia vendas.php cross site scriptingEPSS 0.4%CVE-2024-38156MEDIUMMicrosoft Edge (Chromium-based) Spoofing VulnerabilityEPSS 0.4%CVE-2024-0711MEDIUMButtons Shortcode and Widget <= 1.16 - Stored XSS via shortcodeEPSS 0.4%