Weaknesses of type CWE-79

30,673 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-48311CRITICAL**UNSUPPORTED WHEN ASSIGNED** Cross Site Scripting (XSS) in HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model NEPSS 1.0%CVE-2025-47777CRITICAL5ire Client Vulnerable to Cross-Site Scripting (XSS) and Remote Code Execution (RCE)EPSS 1.0%CVE-2020-36636LOWOpenMRS Admin UI Module Account Setup AccountPageController.java sendErrorMessage cross site scriptingEPSS 1.0%CVE-2021-25017—Tutor LMS < 1.9.12 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2018-15635MEDIUMCross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remoteEPSS 1.0%CVE-2023-43701MEDIUMApache Superset: Stored XSS on API endpointEPSS 1.0%CVE-2020-26198MEDIUMDell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in the iDRAC9 web applicaEPSS 1.0%CVE-2023-7312MEDIUMNagios Fusion < 4.2.0 Email Settings Stored XSS via SMTP/sendmailEPSS 1.0%CVE-2025-52875MEDIUMIn JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possibleEPSS 1.0%CVE-2024-54133LOWPossible Content Security Policy bypass in Action DispatchEPSS 1.0%CVE-2022-21715MEDIUMCross-site Scripting Vulnerability in CodeIgniter4EPSS 1.0%CVE-2020-15276HIGHCross Site Scripting in baserCMSEPSS 1.0%CVE-2020-15781—A vulnerability has been identified in SICAM WEB firmware for SICAM A8000 RTUs (All versions < V05.30). The login screen does not sufficientEPSS 1.0%CVE-2017-2607MEDIUMjenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). JenkinEPSS 1.0%CVE-2021-24955—ProfilePress < 3.2.3 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2022-21710MEDIUMCross-site Scripting in ShortDescription extensionEPSS 1.0%CVE-2022-23081—Openlibrary - Reflected XSSEPSS 1.0%CVE-2021-24954—ProfilePress < 3.2.3 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2022-30120—XSS in /dashboard/blocks/stacks/view_details/ - old browsers only. When using an older browser with built-in XSS protection disabled, insuffEPSS 1.0%CVE-2018-16887MEDIUMA cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations aEPSS 1.0%