Weaknesses of type CWE-79

28,618 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-39346MEDIUMGoogle Maps Easy <= 1.9.33 Authenticated Stored Cross-Site ScriptingEPSS 1.0%CVE-2023-4202CRITICALStored Cross-Site ScriptingEPSS 1.0%CVE-2025-25612HIGHFS Inc S3150-8T2F prior to version S3150-8T2F_2.2.0D_135103 is vulnerable to Cross Site Scripting (XSS) in the Time Range Configuration funcEPSS 1.0%CVE-2018-18985—Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2EPSS 1.0%CVE-2025-69210LOWFacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File UploadEPSS 1.0%CVE-2020-8198—Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 andEPSS 1.0%CVE-2024-34070CRITICALFroxlor Vulnerable to Blind XSS Leading to Froxlor Application CompromiseEPSS 1.0%CVE-2025-52875MEDIUMIn JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possibleEPSS 1.0%CVE-2023-35054MEDIUMIn JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possibleEPSS 1.0%CVE-2024-33338HIGHCross Site Scripting vulnerability in jizhicms v.2.5.4 allows a remote attacker to obtain sensitive information via a crafted article publicEPSS 1.0%CVE-2017-7422—Reflected and stored Cross-Site Scripting (XSS, CWE-79) vulnerabilities in esfadmingui in Micro Focus Enterprise Developer and Enterprise SeEPSS 1.0%CVE-2021-38320MEDIUMsimpleSAMLphp Authentication <= 0.7.0 Reflected Cross-Site ScriptingEPSS 1.0%CVE-2024-3166LOWCross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llmEPSS 1.0%CVE-2022-34257MEDIUMAdobe Commerce Stored XSS Arbitrary code executionEPSS 1.0%CVE-2023-35394MEDIUMAzure HDInsight Jupyter Notebook Spoofing VulnerabilityEPSS 1.0%CVE-2021-24954—ProfilePress < 3.2.3 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2025-51396MEDIUMA stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via inEPSS 1.0%CVE-2020-7690—All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via theEPSS 1.0%CVE-2021-24955—ProfilePress < 3.2.3 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2021-43409CRITICALWPO365 | LOGIN - Wordpress Plugin Persistent Cross-Site ScriptingEPSS 1.0%