Weaknesses of type CWE-79

28,384 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-26829MEDIUMOpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.EPSS 48.0%KEVCVE-2011-0096MEDIUMThe MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 GoldEPSS 46.8%CVE-2023-37580MEDIUMZimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.EPSS 46.7%KEVCVE-2022-39197MEDIUMAn XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTMEPSS 46.4%KEVCVE-2025-0133LOWPAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Gateway and PortalEPSS 46.4%CVE-2024-43573MEDIUMWindows MSHTML Platform Spoofing VulnerabilityEPSS 46.1%KEVCVE-2022-45938HIGHAn issue was discovered in Comcast Defined Technologies microeisbss through 2021. An attacker can inject a stored XSS payload in the Device EPSS 45.1%CVE-2025-6023HIGHAn open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introdEPSS 45.0%CVE-2022-28818MEDIUMColdFusion Reflected Cross-Site Scripting could lead to Arbitrary Code ExecutionEPSS 44.8%CVE-2024-53457MEDIUMA stored cross-site scripting (XSS) vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to executeEPSS 44.6%CVE-2022-3062MEDIUMSimple File List < 4.4.12 - Reflected Cross-Site ScriptingEPSS 44.1%CVE-2023-0448MEDIUMThe WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected croEPSS 42.9%CVE-2025-29513MEDIUMCross-Site Scripting (XSS) vulnerability in NodeBB v4.0.4 and before allows remote attackers to store arbitrary code in the admin API AccessEPSS 42.8%CVE-2022-43568HIGHReflected Cross-Site Scripting via the radio template in Splunk EnterpriseEPSS 42.8%CVE-2020-13954—Apache CXF Reflected XSS in the services listing page via the styleSheetPathEPSS 40.9%CVE-2021-41184MEDIUMXSS in the `of` option of the `.position()` utilEPSS 40.8%CVE-2021-32671CRITICALXSS vulnerability with translatorEPSS 39.7%CVE-2021-41182MEDIUMXSS in the `altField` option of the Datepicker widgetEPSS 39.4%CVE-2024-57041MEDIUMA persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' seEPSS 39.3%CVE-2023-30777HIGHWordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)EPSS 38.8%