Weaknesses of type CWE-79

30,469 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-24563—Frontend Uploader <= 1.3.2 - Unauthenticated Stored Cross-Site ScriptingEPSS 26.3%CVE-2025-12101MEDIUMCross-Site Scripting (XSS)EPSS 26.3%CVE-2007-4465MEDIUMCross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated pEPSS 26.2%CVE-2024-24494MEDIUMCross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, prEPSS 25.9%CVE-2024-7008MEDIUMCalibre Reflected Cross-Site Scripting (XSS)EPSS 25.6%CVE-2023-47505MEDIUMWordPress Elementor Website Builder Plugin <= 3.16.4 is vulnerable to Cross Site Scripting (XSS)EPSS 25.3%CVE-2025-8155MEDIUMD-Link DCS-6010L Management Application vb.htm cross site scriptingEPSS 25.3%CVE-2024-43365MEDIUMStored Cross-site Scripting (XSS) when creating external links in CactiEPSS 25.1%CVE-2024-27443MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite EPSS 24.6%KEVCVE-2024-37389MEDIUMApache NiFi: Improper Neutralization of Input in Parameter Context DescriptionEPSS 24.0%CVE-2020-2036HIGHPAN-OS: Reflected Cross-Site Scripting (XSS) vulnerability in management web interfaceEPSS 23.9%CVE-2023-34941MEDIUMA stored cross-site scripting (XSS) vulnerability in the urlFilterList function of Asus RT-N10LX Router v2.0.0.39 allows attackers to executEPSS 23.8%CVE-2022-29455MEDIUMWordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerabilityEPSS 23.7%CVE-2020-8191—Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 andEPSS 23.5%CVE-2024-3378MEDIUMiboss Secure Web Gateway Login Portal login cross site scriptingEPSS 23.1%CVE-2024-39123MEDIUMIn janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitizEPSS 23.1%CVE-2018-19943HIGHIf exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these isEPSS 22.7%KEVCVE-2014-2120MEDIUMCross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackerEPSS 22.6%KEVCVE-2024-44309MEDIUMA cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, EPSS 21.9%KEVCVE-2025-34175MEDIUMNetgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site ScriptingEPSS 21.3%