Weaknesses of type CWE-79

28,384 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-1094HIGHMonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/food`EPSS 1.2%CVE-2019-11281LOWRabbitMQ XSS attackEPSS 1.2%CVE-2022-0879—Caldera Forms < 1.9.7 - Reflected Cross-Site ScriptingEPSS 1.2%CVE-2025-41420CRITICALA cross-site scripting (xss) vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commEPSS 1.2%CVE-2021-24876—Registrations for The Events Calendar < 2.7.5 - Reflected Cross-Site ScriptingEPSS 1.2%CVE-2023-5546MEDIUMMoodle: stored xss in quiz grading report via user id numberEPSS 1.2%CVE-2021-24878—SupportCandy < 2.2.7 - Reflected Cross-Site ScriptingEPSS 1.2%CVE-2024-21911MEDIUMCross-site scripting vulnerability in TinyMCEEPSS 1.2%CVE-2023-25727MEDIUMIn phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-anEPSS 1.2%CVE-2021-4231LOWAngular Comment cross site scriptingEPSS 1.2%CVE-2022-46907—Apache JSPWiki: XSS Injection points in several pluginsEPSS 1.2%CVE-2023-28158MEDIUMApache Archiva privilege escalationEPSS 1.2%CVE-2022-24918LOWReflected XSS in item configuration window of Zabbix FrontendEPSS 1.2%CVE-2022-2362—Download Manager < 3.2.50 - Bypass IP Address Blocking RestrictionEPSS 1.2%CVE-2016-8639MEDIUMIt was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker witEPSS 1.2%CVE-2026-26105HIGHMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 1.2%CVE-2020-3582MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting VulnerabilitiesEPSS 1.2%CVE-2020-3581MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting VulnerabilitiesEPSS 1.2%CVE-2024-21393HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 1.2%CVE-2022-1567MEDIUMWP JS <= 2.0.6 - Reflected Cross-Site ScriptingEPSS 1.2%