Weaknesses of type CWE-79

28,612 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2017-16767—Cross-site scripting (XSS) vulnerability in User Profile in Synology Surveillance Station before 8.1.2-5469 allows remote authenticated userEPSS 1.0%CVE-2021-40721MEDIUMAdobe Connect Reflected Cross Site ScriptingEPSS 1.0%CVE-2020-14502MEDIUMThe web interface of the 1734-AENTR communication module is vulnerable to stored XSS. A remote, unauthenticated attacker could store a malicEPSS 1.0%CVE-2022-23622HIGHCross site scripting in registration template in xwiki-platformEPSS 1.0%CVE-2024-11199MEDIUMRescue Shortcodes <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rescue_progressbar ShortcodeEPSS 1.0%CVE-2022-48311CRITICAL**UNSUPPORTED WHEN ASSIGNED** Cross Site Scripting (XSS) in HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model NEPSS 1.0%CVE-2024-9007MEDIUMjeanmarc77 123solar detailed.php cross site scriptingEPSS 1.0%CVE-2021-25017—Tutor LMS < 1.9.12 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2023-43701MEDIUMApache Superset: Stored XSS on API endpointEPSS 1.0%CVE-2018-15635MEDIUMCross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remoteEPSS 1.0%CVE-2020-26198MEDIUMDell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in the iDRAC9 web applicaEPSS 1.0%CVE-2026-5615MEDIUMgivanz Vvvebjs File Upload Endpoint upload.php cross site scriptingEPSS 1.0%CVE-2022-37461MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitraryEPSS 1.0%CVE-2020-15276HIGHCross Site Scripting in baserCMSEPSS 1.0%CVE-2022-21715MEDIUMCross-site Scripting Vulnerability in CodeIgniter4EPSS 1.0%CVE-2022-3578MEDIUMProfileGrid < 5.1.1 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2020-15781—A vulnerability has been identified in SICAM WEB firmware for SICAM A8000 RTUs (All versions < V05.30). The login screen does not sufficientEPSS 1.0%CVE-2024-54133LOWPossible Content Security Policy bypass in Action DispatchEPSS 1.0%CVE-2025-14340HIGHAdmin Account Takeover via malicious URL payloadEPSS 1.0%CVE-2021-20279—The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.EPSS 1.0%