Weaknesses of type CWE-79

30,469 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-32671CRITICALXSS vulnerability with translatorEPSS 40.0%CVE-2021-41182MEDIUMXSS in the `altField` option of the Datepicker widgetEPSS 39.4%CVE-2023-30777HIGHWordPress Advanced Custom Fields / Advanced Custom Fields PRO plugins <= 6.1.5 vulnerable to Cross Site Scripting (XSS)EPSS 39.0%CVE-2025-52876MEDIUMIn JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possibleEPSS 38.6%CVE-2024-43362HIGHStored Cross-site Scripting (XSS) when creating external links in CactiEPSS 38.6%CVE-2024-43364MEDIUMStored Cross-site Scripting (XSS) when creating external links in CactiEPSS 37.9%CVE-2024-22241MEDIUMAria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges can inject a malicious pEPSS 37.8%CVE-2023-0563LOWPHPGurukul Bank Locker Management System Assign Locker add-locker-form.php cross site scriptingEPSS 37.6%CVE-2021-20323—A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.EPSS 37.2%CVE-2021-21087MEDIUMColdFusion Improper neutralization of web input during page generation could lead to arbitrary JavaScript execution in the browserEPSS 37.1%CVE-2025-52877MEDIUMIn JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possibleEPSS 37.0%CVE-2018-5550—Versions of Epson AirPrint released prior to January 19, 2018 contain a reflective cross-site scripting (XSS) vulnerability, which can allowEPSS 36.9%CVE-2022-28851MEDIUMAEM Reflected XSS Arbitrary code executionEPSS 36.8%CVE-2025-0370MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src ParameterEPSS 36.8%CVE-2024-42008CRITICALA Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attEPSS 34.2%CVE-2024-32479HIGHLibreNMS's Improper Sanitization on Service template name leads to Stored XSSEPSS 34.1%CVE-2025-10573CRITICALStored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScriptEPSS 33.5%CVE-2024-4901HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 33.5%CVE-2024-11182MEDIUMStored XSS vulnerability in MDaemon Email ServerEPSS 33.3%KEVCVE-2024-6886CRITICALInproper Sanitation of field leading to stored XSSEPSS 33.0%