Weaknesses of type CWE-79

30,295 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-11878MEDIUMCategory Post Slider <= 1.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-60859MEDIUMCross Site Scripting (XSS) vulnerability in Gnuboard 5.6.15 allows authenticated attackers to execute arbitrary code via crafted c_id parameEPSS 0.3%CVE-2024-12518MEDIUMshMapper by Teplitsa <= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-25430MEDIUMTrendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the configname parameter on the /cbi_addcert.htmEPSS 0.3%CVE-2025-50978MEDIUMIn Gitblit v1.7.1, a reflected cross-site scripting (XSS) vulnerability exists in the way repository path names are handled. By injecting a EPSS 0.3%CVE-2025-22760HIGHWordPress CodeBard Help Desk plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5520MEDIUMCross-Site Scripting stored in Alkacon OpenCMSEPSS 0.3%CVE-2026-12561MEDIUMtagDiv Composer <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-3887MEDIUMRoyal Elementor Addons and Templates <= 1.3.974 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Builder WidgetEPSS 0.3%CVE-2024-56157MEDIUMiTop vulnerable to Self XSS in CSV ImportEPSS 0.3%CVE-2026-47942MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2025-67683MEDIUMReflected XSS in Quick.CartEPSS 0.3%CVE-2026-109936HIGHOtter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render FilterEPSS 0.3%CVE-2025-11289MEDIUMwestboy CicadasCMS Template Management TemplateFileServiceImpl.java save cross site scriptingEPSS 0.3%CVE-2025-22795HIGHWordPress Multilang Contact Form Plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-61769LOWEmlog vulnerable to stored XSS in file upload functionality in emlogEPSS 0.3%CVE-2025-22776HIGHWordPress WP Bulletin Board Plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-57498MEDIUMCross Site Scripting vulnerability in sayski ForestBlog 20241223 allows a remote attacker to escalate privileges via the article editing funEPSS 0.3%CVE-2023-46596MEDIUMImproper input validation in FireFlow’s VisualFlow workflow editorEPSS 0.3%CVE-2026-22455HIGHWordPress Thebe theme <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%