Weaknesses of type CWE-79

30,673 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-25612HIGHFS Inc S3150-8T2F prior to version S3150-8T2F_2.2.0D_135103 is vulnerable to Cross Site Scripting (XSS) in the Time Range Configuration funcEPSS 1.0%CVE-2021-4169MEDIUMCross-site Scripting (XSS) - Reflected in livehelperchat/livehelperchatEPSS 1.0%CVE-2018-18985—Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2EPSS 1.0%CVE-2025-69210LOWFacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File UploadEPSS 1.0%CVE-2020-8198—Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 andEPSS 1.0%CVE-2021-21383HIGHXSS in Wiki.jsEPSS 1.0%CVE-2023-35054MEDIUMIn JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possibleEPSS 1.0%CVE-2024-33338HIGHCross Site Scripting vulnerability in jizhicms v.2.5.4 allows a remote attacker to obtain sensitive information via a crafted article publicEPSS 1.0%CVE-2025-51398MEDIUMA stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arEPSS 1.0%CVE-2025-51401MEDIUMA stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrEPSS 1.0%CVE-2025-51400MEDIUMA stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbiEPSS 1.0%CVE-2024-3166LOWCross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llmEPSS 1.0%CVE-2024-11252MEDIUMSocial Sharing Plugin – Sassy Social Share <= 3.3.69 - Reflected Cross-Site Scripting via heateor_mastodon_share ParameterEPSS 1.0%CVE-2021-38320MEDIUMsimpleSAMLphp Authentication <= 0.7.0 Reflected Cross-Site ScriptingEPSS 1.0%CVE-2022-2066HIGHCross-site Scripting (XSS) - Reflected in neorazorx/facturascriptsEPSS 1.0%CVE-2022-2470MEDIUMCross-site Scripting (XSS) - Reflected in microweber/microweberEPSS 1.0%CVE-2021-4124HIGHCross-site Scripting (XSS) - Stored in meetecho/janus-gatewayEPSS 1.0%CVE-2023-35394MEDIUMAzure HDInsight Jupyter Notebook Spoofing VulnerabilityEPSS 1.0%CVE-2020-7690—All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via theEPSS 1.0%CVE-2021-43409CRITICALWPO365 | LOGIN - Wordpress Plugin Persistent Cross-Site ScriptingEPSS 1.0%