Weaknesses of type CWE-79

30,669 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-104252CRITICALVitess vttablet /twopcz reflected XSSEPSS 1.2%CVE-2023-30210MEDIUMOURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php.EPSS 1.2%CVE-2021-24234—Ivory Search < 4.6.1 - Reflected Cross Site Scripting (XSS)EPSS 1.2%CVE-2022-43718MEDIUMApache Superset: Cross-Site Scripting vulnerability on upload formsEPSS 1.2%CVE-2023-37581—Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller site configured for untrusted users.EPSS 1.2%CVE-2019-5422—XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitEPSS 1.2%CVE-2024-52943MEDIUMAn issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24697. It allows an authenticated remote attacker to injeEPSS 1.2%CVE-2017-6611—A vulnerability in the web framework code of Cisco Prime Infrastructure 2.2(2) could allow an unauthenticated, remote attacker to conduct a EPSS 1.2%CVE-2020-26210HIGHCross-Site Scripting in BookStackEPSS 1.2%CVE-2021-42363MEDIUMPreview E-Mails for WooCommerce <= 1.6.8 Reflected Cross-Site ScriptingEPSS 1.2%CVE-2026-67189MEDIUMpfSense Plus/CE Stored XSS via Traffic Graphs PTR RecordEPSS 1.2%CVE-2017-16017—sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability.EPSS 1.2%CVE-2023-1094HIGHMonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/food`EPSS 1.2%CVE-2026-49069HIGHWordPress WPZOOM Portfolio plugin <= 1.4.21 - Cross Site Scripting (XSS) vulnerabilityEPSS 1.2%CVE-2019-11281LOWRabbitMQ XSS attackEPSS 1.2%CVE-2024-21911MEDIUMCross-site scripting vulnerability in TinyMCEEPSS 1.2%CVE-2022-0879—Caldera Forms < 1.9.7 - Reflected Cross-Site ScriptingEPSS 1.2%CVE-2022-43167MEDIUMA stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_alerts) of Rukovoditel vEPSS 1.2%CVE-2022-1906—Copyright Proof <= 4.16 - Reflected Cross-Site-ScriptingEPSS 1.2%CVE-2023-25727MEDIUMIn phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-anEPSS 1.2%