Weaknesses of type CWE-79

30,469 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2020-35730MEDIUMAn XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain EPSS 32.9%KEVCVE-2023-24322MEDIUMA reflected cross-site scripting (XSS) vulnerability in the FileDialog.aspx component of mojoPortal v2.7.0.0 allows attackers to execute arbEPSS 31.7%CVE-2025-30349HIGHHorde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted tEPSS 31.3%CVE-2025-20297MEDIUMReflected Cross-Site Scripting (XSS) on Splunk Enterprise through dashboard PDF generation componentEPSS 31.2%CVE-2021-22889—Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of stats.php (and possibly otEPSS 30.5%CVE-2018-19953MEDIUMIf exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issuEPSS 30.5%KEVCVE-2018-6882MEDIUMCross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 EPSS 29.8%KEVCVE-2024-47525HIGHStored XSS ('Cross-site Scripting') in librenms/includes/html/print-alert-rules.phpEPSS 29.6%CVE-2023-30405MEDIUMA cross-site scripting (XSS) vulnerability in Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to execute arbitrary web scEPSS 29.3%CVE-2021-24891—Elementor < 3.4.8 - DOM Cross-Site-ScriptingEPSS 28.9%CVE-2023-1861MEDIUMLimit Login Attempts < 1.7.2 - Subscriber+ Stored XSSEPSS 28.8%CVE-2022-29034MEDIUMA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An error message pop up window in the web interfaEPSS 28.7%CVE-2023-0084HIGHMetform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 28.6%CVE-2024-27781MEDIUMAn improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 throughEPSS 28.2%CVE-2025-31140MEDIUMIn JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles pageEPSS 28.0%CVE-2022-20966MEDIUMA vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conEPSS 27.6%CVE-2025-68461HIGHRoundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG dEPSS 27.4%KEVCVE-2024-21725MEDIUM[20240204] - Core - XSS in mail address outputsEPSS 26.8%CVE-2024-2123HIGHUltimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site ScriptingEPSS 26.7%CVE-2022-32209—# Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::SaniEPSS 26.5%