Weaknesses of type CWE-79

28,619 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-1250—LifterLMS PayPal < 1.4.0 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2022-0542HIGHCross-site Scripting (XSS) - DOM in chatwoot/chatwootEPSS 0.9%CVE-2021-4169MEDIUMCross-site Scripting (XSS) - Reflected in livehelperchat/livehelperchatEPSS 0.9%CVE-2020-25163HIGHOSIsoft PI Vision Cross-site ScriptingEPSS 0.9%CVE-2018-10934MEDIUMA cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles tEPSS 0.9%CVE-2026-55034HIGHMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 0.9%CVE-2026-55021HIGHMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 0.9%CVE-2021-39338MEDIUMMyBB Cross-Poster <= 1.0 Authenticated Stored Cross-Site ScriptingEPSS 0.9%CVE-2022-22571—An authenticated high privileged user can perform a stored XSS attack due to incorrect output encoding in Incapptic connect and affects all EPSS 0.9%CVE-2025-47777CRITICAL5ire Client Vulnerable to Cross-Site Scripting (XSS) and Remote Code Execution (RCE)EPSS 0.9%CVE-2022-2527HIGHAn issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions staEPSS 0.9%CVE-2025-2610HIGHMagnusBilling Stored Cross-Site Scripting in Alarm ModuleEPSS 0.9%CVE-2022-43500MEDIUMCross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary scriEPSS 0.9%CVE-2023-29206CRITICALorg.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX pluginsEPSS 0.9%CVE-2021-24808—BP Better Messages < 1.9.9.41 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2024-45116HIGHAdobe Commerce | Cross-site Scripting (XSS) (CWE-79)EPSS 0.9%CVE-2021-21365MEDIUMCross-Site Scripting in Content RenderingEPSS 0.9%CVE-2023-7027HIGHPOST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via deviceEPSS 0.9%CVE-2016-10366—Kibana versions after and including 4.3 and before 4.6.2 are vulnerable to a cross-site scripting (XSS) attack.EPSS 0.9%CVE-2023-36031HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 0.9%