Weaknesses of type CWE-79

30,673 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2007-1679MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in Horde Groupware Webmail 1.0 allow remote authenticated users to inject arbitrary web EPSS 1.0%CVE-2025-2709MEDIUMYonyou UFIDA ERP-NC login.jsp cross site scriptingEPSS 1.0%CVE-2024-35627MEDIUMtileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /data/v3/?key.EPSS 1.0%CVE-2025-2710MEDIUMYonyou UFIDA ERP-NC menu.jsp cross site scriptingEPSS 1.0%CVE-2008-3935MEDIUMCross-site scripting (XSS) vulnerability in DIC shop_v50 3.0 and earlier and shop_v52 2.0 and earlier allows remote attackers to inject arbiEPSS 1.0%CVE-2025-2711MEDIUMYonyou UFIDA ERP-NC systop.jsp cross site scriptingEPSS 1.0%CVE-2025-64130CRITICALZenitel TCIV-3+ Cross-site ScriptingEPSS 1.0%CVE-2024-21910MEDIUMCross-site scripting vulnerability in TinyMCE pluginsEPSS 1.0%CVE-2021-25963MEDIUMShuup - Reflected XSS in Error PageEPSS 1.0%CVE-2023-1410MEDIUMStored XSS in Graphite FunctionDescription tooltipEPSS 1.0%CVE-2023-36886HIGHMicrosoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityEPSS 1.0%CVE-2021-39345MEDIUMHAL <= 2.1.1 Authenticated Stored Cross-Site ScriptingEPSS 1.0%CVE-2022-36107MEDIUMStored Cross-Site Scripting via FileDumpControllerEPSS 1.0%CVE-2024-30053MEDIUMAzure Migrate Cross-Site Scripting VulnerabilityEPSS 1.0%CVE-2025-53084CRITICALA cross-site scripting (xss) vulnerability exists in the videosList page parameter functionality of WWBN AVideo 14.4 and dev master commit 8EPSS 1.0%CVE-2023-2256—Product Addons & Fields for WooCommerce < 32.0.7 - Reflected Cross-Site ScriptingEPSS 1.0%CVE-2023-34121MEDIUMImproper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated EPSS 1.0%CVE-2020-19947CRITICALCross Site Scripting vulnerability found in Markdown Edit allows a remote attacker to execute arbitrary code via the edit parameter of the wEPSS 1.0%CVE-2017-16018—Restify is a framework for building REST APIs. Restify >=2.0.0 <=4.0.4 using URL encoded script tags in a non-existent URL, an attacker can EPSS 1.0%CVE-2020-10643MEDIUMOSIsoft PI SystemEPSS 1.0%