Weaknesses of type CWE-79

28,384 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-30349HIGHHorde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted tEPSS 31.3%CVE-2026-64638HIGHWordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party websEPSS 31.2%CVE-2025-23200MEDIUMStored XSS-LibreNMS-Misc Section in librenmsEPSS 30.9%CVE-2022-32209—# Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::SaniEPSS 30.2%CVE-2024-47525HIGHStored XSS ('Cross-site Scripting') in librenms/includes/html/print-alert-rules.phpEPSS 29.6%CVE-2023-30405MEDIUMA cross-site scripting (XSS) vulnerability in Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to execute arbitrary web scEPSS 29.3%CVE-2023-1861MEDIUMLimit Login Attempts < 1.7.2 - Subscriber+ Stored XSSEPSS 28.8%CVE-2022-29034MEDIUMA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An error message pop up window in the web interfaEPSS 28.7%CVE-2023-0084HIGHMetform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 28.6%CVE-2024-27781MEDIUMAn improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 throughEPSS 28.2%CVE-2025-31140MEDIUMIn JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles pageEPSS 28.0%CVE-2022-20966MEDIUMA vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conEPSS 27.6%CVE-2025-68461HIGHRoundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG dEPSS 26.8%KEVCVE-2024-2123HIGHUltimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 26.7%CVE-2021-24563—Frontend Uploader <= 1.3.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 26.4%CVE-2007-4465MEDIUMCross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated pEPSS 26.2%CVE-2020-8191—Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 andEPSS 26.1%CVE-2025-20297MEDIUMReflected Cross-Site Scripting (XSS) on Splunk Enterprise through dashboard PDF generation componentEPSS 25.9%CVE-2024-24494MEDIUMCross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, prEPSS 25.9%CVE-2024-7008MEDIUMCalibre Reflected Cross-Site Scripting (XSS)EPSS 25.6%