Weaknesses of type CWE-79

28,620 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-41252HIGHCross-site scripting (XSS) from writer field content in the site frontendEPSS 0.9%CVE-2024-25503MEDIUMCross Site Scripting (XSS) vulnerability in Advanced REST Client v.17.0.9 allows a remote attacker to execute arbitrary code and obtain sensEPSS 0.9%CVE-2026-49069HIGHWordPress WPZOOM Portfolio plugin <= 1.4.21 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.9%CVE-2017-12344—Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into EPSS 0.9%CVE-2020-36636LOWOpenMRS Admin UI Module Account Setup AccountPageController.java sendErrorMessage cross site scriptingEPSS 0.9%CVE-2024-24131MEDIUMSuperWebMailer v9.31.0.01799 was discovered to contain a reflected cross-site scripting (XSS) vulenrability via the component api.php.EPSS 0.9%CVE-2022-3072HIGHCross-site Scripting (XSS) - Stored in francoisjacquet/rosariosisEPSS 0.9%CVE-2023-28120MEDIUMThere is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.EPSS 0.9%CVE-2025-51398MEDIUMA stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arEPSS 0.9%CVE-2025-51400MEDIUMA stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbiEPSS 0.9%CVE-2025-51401MEDIUMA stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrEPSS 0.9%CVE-2018-15451MEDIUMCisco Prime Service Catalog Cross-Site Scripting VulnerabilityEPSS 0.9%CVE-2023-33255MEDIUMAn issue was discovered in Papaya Viewer 1.0.1449. User-supplied input in form of DICOM or NIFTI images can be loaded into the Papaya web apEPSS 0.9%CVE-2024-27082HIGHCacti Cross-site Scripting vulnerability when managing treesEPSS 0.9%CVE-2020-3466MEDIUMCisco DNA Center Cross-Site Scripting VulnerabilitiesEPSS 0.9%CVE-2026-33933MEDIUMReflected XSS via Unescaped contextName Parameter in Custom Template EditorEPSS 0.9%CVE-2022-44952MEDIUMRukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/applicatioEPSS 0.9%CVE-2024-32391HIGHCross Site Scripting vulnerability in MacCMS v.10 v.2024.1000.3000 allows a remote attacker to execute arbitrary code via a crafted payload.EPSS 0.9%CVE-2013-4170—In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, theEPSS 0.9%CVE-2023-3521MEDIUMCross-site Scripting (XSS) - Reflected in fossbilling/fossbillingEPSS 0.9%