Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-64339HIGHClipBucket v5: Stored XSS Vulnerability in Manage PlaylistsEPSS 0.3%CVE-2026-107759HIGHWPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mailEPSS 0.3%CVE-2025-3019MEDIUMCross-site scripting vulnerabilities in KNIME Business Hub web pagesEPSS 0.3%CVE-2026-4578MEDIUMcode-projects Exam Form Submission update_s3.php cross site scriptingEPSS 0.3%CVE-2026-88208MEDIUMMicrosoft Office SharePoint Spoofing VulnerabilityEPSS 0.3%CVE-2025-29280MEDIUMStored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface aEPSS 0.3%CVE-2024-2923MEDIUMMagical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) <= 1.1.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Effect WidgetEPSS 0.3%CVE-2024-43330HIGHWordPress PowerPack for Beaver Builder plugin < 2.37.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-100316HIGHEuropean VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry HeaderEPSS 0.3%CVE-2024-35706HIGHWordPress Heateor Social Login WordPress plugin <= 1.1.32 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-41591MEDIUMDrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS.EPSS 0.3%CVE-2026-118257HIGHVue I18n: escapeParameter does not prevent XSS through srcdoc in translation messagesEPSS 0.3%CVE-2024-5789MEDIUMTriton Lite <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button ShortcodeEPSS 0.3%CVE-2025-53492LOWStored XSS in MintyDocsEPSS 0.3%CVE-2024-46494MEDIUMA cross-site scripting (XSS) vulnerability in Typecho v1.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadEPSS 0.3%CVE-2024-13749MEDIUMStaffList <= 3.2.3 - Cross-Site Request Forgery to Reflected Cross-Site ScriptingEPSS 0.3%CVE-2024-43111CRITICALLong pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects FiEPSS 0.3%CVE-2024-37211HIGHWordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-53974MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2026-2344HIGHStored XSS on Plunet BusinessManagerEPSS 0.3%