Weaknesses of type CWE-79

30,295 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-49502MEDIUMReflected XSS in Setup Wizard, HTTP Proxy credentials pane in spacewalk-webEPSS 0.3%CVE-2025-47458HIGHWordPress B2i Investor Tools plugin <= 1.0.7.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-38329MEDIUMAn issue was discovered in eGroupWare 17.1.20190111. A cross-site scripting Reflected (XSS) vulnerability exists in calendar/freebusy.php, wEPSS 0.3%CVE-2026-34562MEDIUMCI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.3%CVE-2024-41346MEDIUMopenflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/submit.phpEPSS 0.3%CVE-2025-13678MEDIUMThai Lottery Widget <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2024-41943MEDIUMI, Librarian Stored XSS vulnerability in Item SummaryEPSS 0.3%CVE-2024-13445MEDIUMElementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-52585LOWAutolab has HTML Injection VulnerabilityEPSS 0.3%CVE-2024-9888MEDIUMElementInvader Addons for Elementor <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-35655MEDIUMWordPress Brave – Interactive Content plugin <= 0.6.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-3087MEDIUMStored XSS Vulnerability in M-Files WebEPSS 0.3%CVE-2024-43413LOWXibo CMS XSS vulnerability using DataSet HTML columnsEPSS 0.3%CVE-2024-9873MEDIUMCommunity by PeepSo <= 6.4.6.1 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-49503MEDIUMReflected XSS in Setup Wizard, Organization Credentials in spacewalk-webEPSS 0.3%CVE-2026-25144MEDIUMTalishar has a Stored XSS which can lead to data exfiltration & user impersonationEPSS 0.3%CVE-2025-46456HIGHWordPress Theme Blvd Sliders plugin <= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-8765MEDIUMDatacom DM955 5GT 1200 Wireless Basic Settings cross site scriptingEPSS 0.3%CVE-2025-67491HIGHOpenEMR has Stored XSS in ub04 helperEPSS 0.3%CVE-2026-55660HIGHTinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeoverEPSS 0.3%