Weaknesses of type CWE-79

30,673 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-25027—PowerPack Addons for Elementor < 2.6.2 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2024-11004MEDIUMReflected XSS in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticaEPSS 0.9%CVE-2026-22813CRITICALMalicious website can execute commands on the local system through XSS in the OpenCode web UIEPSS 0.9%CVE-2020-35037—Events Manager < 5.9.8 - Cross-Site Scripting (XSS)EPSS 0.9%CVE-2022-39350MEDIUM@dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability DetailsEPSS 0.9%CVE-2021-24885—YOP Poll < 6.1.2 - Reflected Cross-Site ScriptingEPSS 0.9%CVE-2021-39325MEDIUMOptinMonster <= 2.6.0 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2023-25827HIGHCross-site Scripting in OpenTSDBEPSS 0.9%CVE-2024-40101HIGHA Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote atEPSS 0.9%CVE-2022-42989CRITICALERP Sankhya before v4.11b81 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Caixa de Entrada.EPSS 0.9%CVE-2022-0558CRITICALCross-site Scripting (XSS) - Stored in microweber/microweberEPSS 0.9%CVE-2020-7355MEDIUMRapid7 Metasploit Pro Stored XSS in 'notes' fieldEPSS 0.9%CVE-2025-5127MEDIUMTeledyne FLIR AX8 prod.php cross site scriptingEPSS 0.9%CVE-2023-36477CRITICALPersistent Cross-site Scripting (XSS) through CKEditor Configuration pages in XWiki PlatformEPSS 0.9%CVE-2020-7354MEDIUMRapid7 Metasploit Pro Stored XSS in 'host' fieldEPSS 0.9%CVE-2022-0723HIGHCross-site Scripting (XSS) - Reflected in microweber/microweberEPSS 0.9%CVE-2024-50859MEDIUMThe ip_import_acl_csv request in GestioIP v3.5.7 is vulnerable to Reflected XSS. When a user uploads an improperly formatted file, the conteEPSS 0.9%CVE-2025-51501MEDIUMReflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows executionEPSS 0.9%CVE-2022-0965CRITICALStored XSS viva .ofd file upload in star7th/showdocEPSS 0.9%CVE-2022-2036CRITICALCross-site Scripting (XSS) - Stored in francoisjacquet/rosariosisEPSS 0.9%