Weaknesses of type CWE-79

29,846 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-82653CRITICALSiYuan before v3.8.1 Stored XSS via confirmDialogEPSS 0.4%CVE-2023-2109MEDIUMCross-site Scripting (XSS) - DOM in chatwoot/chatwootEPSS 0.4%CVE-2024-32768MEDIUMPhoto StationEPSS 0.4%CVE-2025-15223MEDIUMPhilipinho Simple-PHP-Blog login.php cross site scriptingEPSS 0.4%CVE-2024-2299HIGHStored Cross-Site Scripting (XSS) via Profile Picture Upload in parisneo/lollms-webuiEPSS 0.4%CVE-2024-32769MEDIUMPhoto StationEPSS 0.4%CVE-2023-41250LOWIn JetBrains TeamCity before 2023.05.3 reflected XSS was possible during user registrationEPSS 0.4%CVE-2026-102173HIGHKirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration MetadataEPSS 0.4%CVE-2024-3174HIGHInappropriate implementation in V8 in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially exploit object corruptiEPSS 0.4%CVE-2025-11946MEDIUMLogicalDOC Community Edition Add Contact frontend.jsp cross site scriptingEPSS 0.4%CVE-2023-38536MEDIUMHTML injection in OpenText™ Exceed Turbo X affecting version 12.5.1. The vulnerability could result in Cross site scripting.  EPSS 0.4%CVE-2024-9892MEDIUMAdd Widget After Content <= 2.4.6 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-29188MEDIUMCross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UIEPSS 0.4%CVE-2024-21515LOWThis affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the filename parameter of the aEPSS 0.4%CVE-2023-0578MEDIUMMultiple XSS in ASOS Information Technologies' Book CitesEPSS 0.4%CVE-2024-32770MEDIUMPhoto StationEPSS 0.4%CVE-2024-32767MEDIUMPhoto StationEPSS 0.4%CVE-2022-41299MEDIUMIBM Cloud Transformation Advisor cross-site scriptingEPSS 0.4%CVE-2023-27617MEDIUMWordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-0577MEDIUMMultiple XSS in ASOS Information Technologies' SobiadEPSS 0.4%