Weaknesses of type CWE-79

29,761 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-46948MEDIUMA reflected Cross-Site Scripting (XSS) vulnerability was found on Temenos T24 Browser R19.40 that enables a remote attacker to execute arbitEPSS 0.4%CVE-2025-1319HIGHSite Mailer <= 1.2.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-11368MEDIUMSplash Sync <= 2.0.7 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-4632MEDIUMWooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-26266CRITICALAliasVault affected by Cross-Site Scripting (XSS) via Email HTML RenderingEPSS 0.4%CVE-2023-20074MEDIUMMultiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthentiEPSS 0.4%CVE-2024-5062MEDIUMReflected XSS through survey redirect parameter in zenml-io/zenmlEPSS 0.4%CVE-2024-49764MEDIUMLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/capture.inc.phpEPSS 0.4%CVE-2024-11683MEDIUMNewsletter Subscriptions <= 2.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-4333MEDIUMSina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site ScriptingEPSS 0.4%CVE-2026-53722MEDIUMNuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URLEPSS 0.4%CVE-2024-12260MEDIUMUltimate Endpoints With Rest Api <= 2.2.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2021-46680MEDIUMVulnerability XSS in module form name fieldEPSS 0.4%CVE-2025-1085MEDIUMAnimati PACS login cross site scriptingEPSS 0.4%CVE-2024-50350MEDIUMLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.phpEPSS 0.4%CVE-2026-44282MEDIUMElection question titles allow stored script executionEPSS 0.4%CVE-2023-20041MEDIUMMultiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthentiEPSS 0.4%CVE-2022-36783MEDIUMAlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS)EPSS 0.4%CVE-2026-45025MEDIUMWeGIA: Stored XSS in html/atendido/etapa_processo.phpEPSS 0.4%CVE-2023-50303MEDIUMIBM InfoSphere Information Server cross-site scriptingEPSS 0.4%