Weaknesses of type CWE-79

30,673 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-50128CRITICALA cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg parameter functionality of WWBN AVideo 14.4 and dev masteEPSS 1.0%CVE-2022-2217CRITICALCross-site Scripting (XSS) - Generic in ionicabizau/parse-urlEPSS 1.0%CVE-2021-4284LOWOpenMRS HTML Form Entry UI Framework Integration Module cross site scriptingEPSS 1.0%CVE-2020-15154HIGHCross Site Scripting in baserCMSEPSS 1.0%CVE-2024-4455HIGHYITH WooCommerce Ajax Search <= 2.4.0 - Unauthenticated Stored Cross-Site ScriptingEPSS 1.0%CVE-2019-19294MEDIUMA vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The web interface of the Control Center Server (EPSS 1.0%CVE-2017-16767—Cross-site scripting (XSS) vulnerability in User Profile in Synology Surveillance Station before 8.1.2-5469 allows remote authenticated userEPSS 1.0%CVE-2026-70306CRITICALMicrosoft Office SharePoint Spoofing VulnerabilityEPSS 1.0%CVE-2018-8911MEDIUMCross-site scripting (XSS) vulnerability in Attachment Preview in Synology Note Station before 2.5.1-0844 allows remote authenticated users EPSS 1.0%CVE-2017-12072—Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.8.0-3456 allows remote authenticated uEPSS 1.0%CVE-2022-1396—Donorbox < 7.1.7 - Admin+ Stored Cross-Site ScriptingEPSS 1.0%CVE-2022-1558—Curtain <= 1.0.2 - Admin+ Stored Cross-Site ScriptingEPSS 1.0%CVE-2018-8912MEDIUMCross-site scripting (XSS) vulnerability in SYNO.NoteStation.Note in Synology Note Station before 2.5.1-0844 allows remote authenticated useEPSS 1.0%CVE-2022-1559—Clipr <= 1.2.3 - Admin+ Stored Cross-Site ScriptingEPSS 1.0%CVE-2021-3945HIGHCross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdeskEPSS 1.0%CVE-2022-23622HIGHCross site scripting in registration template in xwiki-platformEPSS 1.0%CVE-2021-40721MEDIUMAdobe Connect Reflected Cross Site ScriptingEPSS 1.0%CVE-2025-4859MEDIUMD-Link DAP-2695 MAC Bypass Settings Page adv_macbypass.php cross site scriptingEPSS 1.0%CVE-2020-14502MEDIUMThe web interface of the 1734-AENTR communication module is vulnerable to stored XSS. A remote, unauthenticated attacker could store a malicEPSS 1.0%CVE-2024-9007MEDIUMjeanmarc77 123solar detailed.php cross site scriptingEPSS 1.0%