Weaknesses of type CWE-79

29,772 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-86431MEDIUMcommonmark before 2.9.1 XSS via AttributesExtension form feed bypassEPSS 0.4%CVE-2025-23697HIGHWordPress Podčlánková inzerce plugin <= 2.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-6423MEDIUMCross-site Scripting vulnerability in BigProf productsEPSS 0.4%CVE-2023-25614MEDIUMSAP NetWeaver AS ABAP (BSP Framework) application - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allow an unautEPSS 0.4%CVE-2023-4175LOWmooSocial mooTravel cross site scriptingEPSS 0.4%CVE-2023-3827LOWBug Finder Listplace Directory Listing Platform HTTP POST Request create cross site scriptingEPSS 0.4%CVE-2024-7737HIGHStored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.4%CVE-2023-4594MEDIUMCross-site Scripting in BVRP Software SLmailEPSS 0.4%CVE-2022-27860MEDIUMWordPress Footer Text plugin <= 2.0.3 - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-6011MEDIUMStored XSS in GeodiEPSS 0.4%CVE-2023-3659LOWSourceCodester AC Repair and Services System cross site scriptingEPSS 0.4%CVE-2023-3544LOWGZ Scripts Time Slot Booking Calendar PHP load.php cross site scriptingEPSS 0.4%CVE-2023-6426MEDIUMCross-site Scripting vulnerability in BigProf productsEPSS 0.4%CVE-2023-6359MEDIUMCross-Site Scripting in Alumne LMSEPSS 0.4%CVE-2024-9291MEDIUMkalvinGit kvf-admin XML File cross site scriptingEPSS 0.4%CVE-2025-45805HIGHIn phpgurukul Doctor Appointment Management System 1.0, an authenticated doctor user can inject arbitrary JavaScript code into their profileEPSS 0.4%CVE-2022-29436MEDIUMWordPress Code Snippets Extended plugin <= 1.4.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Persistent Cross-Site Scripting (XSS)EPSS 0.4%CVE-2026-53610HIGHGLPI: Reflected XSS in dashboardsEPSS 0.4%CVE-2022-40034MEDIUMCross-Site Scripting (XSS) vulnerability found in Rawchen blog-ssm v1.0 allows attackers to execute arbitrary code via the 'notifyInfo' paraEPSS 0.4%CVE-2024-31783MEDIUMCross Site Scripting (XSS) vulnerability in Typora v.1.6.7 and before, allows a local attacker to obtain sensitive information via a craftedEPSS 0.4%