Weaknesses of type CWE-79

29,914 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-20248MEDIUMA vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, reEPSS 0.4%CVE-2023-20249MEDIUMA vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, reEPSS 0.4%CVE-2024-13392MEDIUMRate Star Review Vote – AJAX Reviews, Votes, Star Ratings <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-27599MEDIUMCI4MS: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.4%CVE-2023-47524MEDIUMWordPress CodeBard's Patron Button and Widgets for Patreon Plugin <= 2.1.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-47099LOWTeleJSON < 6.0.0 DOM-based XSS via parse() FunctionEPSS 0.4%CVE-2026-17209MEDIUMIBM Db2 Mirror for i is affected by multiple vulnerabilitiesEPSS 0.4%CVE-2023-51735MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2026-111984MEDIUMAUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scriptingEPSS 0.4%CVE-2025-13732MEDIUMs2Member <= 251005 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-51723MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2023-51739MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2023-23786MEDIUMWordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.3.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-51722MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2023-51730MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2026-62368HIGHSnipe-IT: Stored XSS via Custom Field name in asset-list column headersEPSS 0.4%CVE-2025-13612MEDIUMAlbum and Image Gallery Plus Lightbox <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's ShortcodeEPSS 0.4%CVE-2024-9276MEDIUMTMsoft MyAuth Gateway index.php cross site scriptingEPSS 0.4%CVE-2023-51736MEDIUMStored Cross Site Scripting Vulnerability in Skyworth RouterEPSS 0.4%CVE-2023-28622MEDIUMWordPress Easy Slider Revolution Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%