Weaknesses of type CWE-79

30,295 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-43412MEDIUMXibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JSEPSS 0.3%CVE-2024-53266MEDIUMCross-site Scripting (XSS) via topic titles when CSP disabled in DiscourseEPSS 0.3%CVE-2025-42975MEDIUMMultiple vulnerabilities in SAP NetWeaver Application Server ABAP (BIC Document)EPSS 0.3%CVE-2024-51573MEDIUMWordPress ML Responsive Audio plugin <= 0.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-9703MEDIUMArconix Shortcodes <= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-4581MEDIUMSlider Revolution <= 6.7.11 - Authenticated (Author+) Stored Cross-Site Scripting via Add Layer class, id, and title AttributesEPSS 0.3%CVE-2025-1064MEDIUMLogin/Signup Popup ( Inline Form + Woocommerce ) <= 2.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action ShortcodeEPSS 0.3%CVE-2020-37018MEDIUMGOautodial 4.0 - Persistent Cross-Site ScriptingEPSS 0.3%CVE-2024-6620LOWHoneywell PC42t, PC42tp, and PC42d Printers, T10.19.020016 to T10.20.060398, contain a cross-site scripting vulnerability. A(n) attacker couEPSS 0.3%CVE-2026-63168MEDIUMOmnispace Agora Project < 26.10.0 Stored XSS via Nested POST Array BypassEPSS 0.3%CVE-2024-35739MEDIUMWordPress The Post Grid plugin <= 7.7.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-9169MEDIUMlitespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-9868MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age GateEPSS 0.3%CVE-2024-1341MEDIUMAdvanced iFrame <= 2024.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-30366MEDIUMWeGIA vulnerable to Stored XSS in personalizacao.phpEPSS 0.3%CVE-2024-4705MEDIUMTestimonials Widget <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via testimonials ShortcodeEPSS 0.3%CVE-2025-0554MEDIUMPodlove Podcast Publisher <= 4.1.25 - Authenticated (Admin+) Stored Cross-Site Scripting via Feed NameEPSS 0.3%CVE-2025-49126HIGHVisionatrix Vulnerable to Reflected XSS Leading to Exfiltration of SecretsEPSS 0.3%CVE-2025-13841MEDIUMSmart App Banners <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' and 'verticalalign' Shortcode AttributesEPSS 0.3%CVE-2026-4332MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%