Weaknesses of type CWE-79

29,667 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-4879LOWCross-site Scripting (XSS) - Stored in instantsoft/icms2EPSS 0.4%CVE-2021-40337MEDIUMOWASP Related Vulnerabilities in Hitachi Energy’s LinkOne ProductEPSS 0.4%CVE-2024-11786MEDIUMLogin with Vipps and MobilePay <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2022-45215MEDIUMA cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML EPSS 0.4%CVE-2025-8346MEDIUMPortabilis i-Educar educar_aluno_lst.php cross site scriptingEPSS 0.4%CVE-2023-50832MEDIUMWordPress Multi Step Form Plugin <= 1.7.13 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-49151MEDIUMWordPress Google Calendar Events Plugin <= 3.2.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-85982CRITICALStored Cross-Site Scripting (XSS) in Auth0 AD/LDAP ConnectorEPSS 0.4%CVE-2026-69690MEDIUMMicrosoft Office SharePoint Spoofing VulnerabilityEPSS 0.4%CVE-2023-27612MEDIUMWordPress Site Reviews Plugin <= 6.5.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-5757MEDIUMElementor Header & Footer Builder <= 1.6.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Title WidgetEPSS 0.4%CVE-2024-12738MEDIUMUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-5374MEDIUMKashipara College Management System submit_new_faculty.php cross site scriptingEPSS 0.4%CVE-2024-1267LOWCodeAstro Restaurant POS System create_account.php cross site scriptingEPSS 0.4%CVE-2024-37859MEDIUMCross Site Scripting vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the page parEPSS 0.4%CVE-2024-48937MEDIUMZnuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows XSS. JavaScript code in the short description of the SLA field in ActiEPSS 0.4%CVE-2024-7368MEDIUMSourceCodester Simple Realtime Quiz System ajax.php cross site scriptingEPSS 0.4%CVE-2022-38110MEDIUMReflected Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2024-9219MEDIUMWordPress Social Share Buttons <= 1.19 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-9896MEDIUMBBP Core – Expand bbPress powered forums with useful features <= 1.2.5 - Reflected Cross-Site Scripting via add_query_arg ParameterEPSS 0.4%