Weaknesses of type CWE-79

30,021 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-52812MEDIUMLF Edge eKuiper has Stored XSS in Rules FunctionalityEPSS 0.3%CVE-2024-50656MEDIUMitsourcecode Placement Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Full Name field in registration.php.EPSS 0.3%CVE-2024-8799MEDIUMCustom Banners <= 3.3 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2026-94034MEDIUMSourceCodester Drug Recommendation System Password Change change_password cross site scriptingEPSS 0.3%CVE-2024-9462MEDIUMPoll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Poll SettingsEPSS 0.3%CVE-2026-90694MEDIUMSourceCodester Inventory Management System Customer Management customers_handler.php cross site scriptingEPSS 0.3%CVE-2026-19922MEDIUMcode-projects Online Shopping System checkout.php cross site scriptingEPSS 0.3%CVE-2026-59923MEDIUMMistune: XSS via percent-encoded javascript URI bypass in safe_url()EPSS 0.3%CVE-2023-34977MEDIUMVideo StationEPSS 0.3%CVE-2023-23475MEDIUMIBM Infosphere Information Server cross-site scriptingEPSS 0.3%CVE-2026-34089LOWMemory leak in Scribunto causes runJobs.php to run out of memoryEPSS 0.3%CVE-2025-44108MEDIUMA stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions coEPSS 0.3%CVE-2025-1905MEDIUMSourceCodester Employee Management System employee.php cross site scriptingEPSS 0.3%CVE-2026-116514MEDIUMitsourcecode Airline Reservation System book_flight.php cross site scriptingEPSS 0.3%CVE-2025-9656MEDIUMPHPGurukul Directory Management System add-directory.php cross site scriptingEPSS 0.3%CVE-2023-22595MEDIUMIBM B2B Advanced Communication cross-site scriptingEPSS 0.3%CVE-2024-32877MEDIUMReflected Cross-site Scripting in yiisoft/yii2 Debug modeEPSS 0.3%CVE-2025-49486HIGHExtension - balbooa.com - Stored XSS in Balbooa Gallery component version 1.0.0 - 2.4.0 for JoomlaEPSS 0.3%CVE-2026-47666HIGHPenpot: Stored XSS via custom font family name injected into a @font-face style ruleEPSS 0.3%CVE-2024-46079MEDIUMScriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in proj_new.php via the Descricao parameter.EPSS 0.3%