Weaknesses of type CWE-79

28,635 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-11201MEDIUMmyCred – Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send ShortcodeEPSS 0.9%CVE-2022-2890CRITICALCross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmEPSS 0.9%CVE-2016-9130—Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists,EPSS 0.9%CVE-2021-38356MEDIUMNextScripts: Social Networks Auto-Poster <= 4.3.20 Reflected Cross-Site ScriptingEPSS 0.9%CVE-2024-0282LOWKashipara Food Management System addmaterialsubmit.php cross site scriptingEPSS 0.9%CVE-2021-43558—A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in thEPSS 0.9%CVE-2021-21340MEDIUMCross-Site Scripting in Content PreviewEPSS 0.9%CVE-2021-21358MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-formEPSS 0.9%CVE-2021-21370MEDIUMCross-Site Scripting in Content Preview (CType menu)EPSS 0.9%CVE-2017-12307—A vulnerability in the web framework of Cisco Small Business Managed Switches software could allow an unauthenticated, remote attacker to coEPSS 0.9%CVE-2023-0742HIGHCross-site Scripting (XSS) - Stored in answerdev/answerEPSS 0.9%CVE-2025-56432MEDIUMA cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. The vulnerability allows remote attackers to execute arbitrary JavaScEPSS 0.9%CVE-2024-34224HIGHCross Site Scripting vulnerability in /php-lms/classes/Users.php?f=save in Computer Laboratory Management System using PHP and MySQL 1.0 allEPSS 0.9%CVE-2023-0741HIGHCross-site Scripting (XSS) - DOM in answerdev/answerEPSS 0.9%CVE-2021-43841MEDIUMXSS by SVG upload in xwiki-platformEPSS 0.9%CVE-2022-1571CRITICALCross-site scripting - Reflected in Create Subaccount in neorazorx/facturascriptsEPSS 0.9%CVE-2025-14499HIGHIceWarp gmaps Cross-Site Scripting Authentication Bypass VulnerabilityEPSS 0.9%CVE-2023-33977HIGHStored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMSEPSS 0.9%CVE-2022-0501HIGHCross-site Scripting (XSS) - Reflected in ptrofimov/beanstalk_consoleEPSS 0.9%CVE-2023-0625HIGHDocker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelogEPSS 0.9%