Weaknesses of type CWE-79

29,772 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-92730HIGHLimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column nameEPSS 0.4%CVE-2023-44984MEDIUMWordPress bbp style pack Plugin <= 5.6.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-52482HIGHChamilo: Stored XSS in glossary function via /main/glossary/index.php trigger in /main/tracking/course_log_resources.phpEPSS 0.4%CVE-2022-4954MEDIUMWaiting: One-click countdowns <= 0.6.2 - Authenticated (Administrator+) Cross-Site ScriptingEPSS 0.4%CVE-2023-46099MEDIUMA vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). There is a stored cross-site scripting vulnerability in the AdEPSS 0.4%CVE-2023-3475LOWSimplePHPscripts Event Script URL Parameter preview.php cross site scriptingEPSS 0.4%CVE-2025-23758HIGHWordPress pootle button plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-6432MEDIUMCross-site Scripting vulnerability in BigProf productsEPSS 0.4%CVE-2025-23686HIGHWordPress Admin Menu Organizer plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-6431MEDIUMCross-site Scripting vulnerability in BigProf productsEPSS 0.4%CVE-2023-1447LOWSourceCodester Medicine Tracker System cross site scriptingEPSS 0.4%CVE-2023-3828LOWBug Finder Listplace Directory Listing Platform Photo coverPhotoUpdate cross site scriptingEPSS 0.4%CVE-2024-7016MEDIUMStored XSS in Smarttek Informatics' Smart DoctorEPSS 0.4%CVE-2023-24521MEDIUMDue to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 7EPSS 0.4%CVE-2023-6429MEDIUMCross-site Scripting vulnerability in BigProf productsEPSS 0.4%CVE-2023-1593LOWSourceCodester Automatic Question Paper Generator System cross site scriptingEPSS 0.4%CVE-2024-2840MEDIUMEnhanced Media Library <= 2.8.9 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-5303LOWOnline Banquet Booking System Account Detail view-booking-detail.php cross site scriptingEPSS 0.4%CVE-2023-6434MEDIUMCross-site Scripting vulnerability in BigProf productsEPSS 0.4%CVE-2025-66024HIGHXWiki Blog Application home page vulnerable to Stored XSS via Post TitleEPSS 0.4%