Weaknesses of type CWE-79

28,451 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-12101MEDIUMCross-Site Scripting (XSS)EPSS 25.4%CVE-2023-47505MEDIUMWordPress Elementor Website Builder Plugin <= 3.16.4 is vulnerable to Cross Site Scripting (XSS)EPSS 25.3%CVE-2018-6882MEDIUMCross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 EPSS 25.3%KEVCVE-2021-24891—Elementor < 3.4.8 - DOM Cross-Site-ScriptingEPSS 25.1%CVE-2024-43365MEDIUMStored Cross-site Scripting (XSS) when creating external links in CactiEPSS 25.1%CVE-2025-52876MEDIUMIn JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possibleEPSS 24.5%CVE-2024-37389MEDIUMApache NiFi: Improper Neutralization of Input in Parameter Context DescriptionEPSS 24.0%CVE-2018-19953MEDIUMIf exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issuEPSS 23.9%KEVCVE-2020-2036HIGHPAN-OS: Reflected Cross-Site Scripting (XSS) vulnerability in management web interfaceEPSS 23.9%CVE-2025-52877MEDIUMIn JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possibleEPSS 23.8%CVE-2023-34941MEDIUMA stored cross-site scripting (XSS) vulnerability in the urlFilterList function of Asus RT-N10LX Router v2.0.0.39 allows attackers to executEPSS 23.8%CVE-2022-29455MEDIUMWordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerabilityEPSS 23.7%CVE-2024-27443MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite EPSS 23.6%KEVCVE-2024-39123MEDIUMIn janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitizEPSS 23.1%CVE-2024-44309MEDIUMA cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, EPSS 22.6%KEVCVE-2024-3378MEDIUMiboss Secure Web Gateway Login Portal login cross site scriptingEPSS 22.0%CVE-2024-27162MEDIUMDOM-based XSSEPSS 21.2%CVE-2024-55416LOWDevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on aEPSS 20.3%CVE-2025-66376HIGHZimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import dEPSS 19.6%KEVCVE-2026-20945MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 19.1%