Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-36372MEDIUMIn JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possibleEPSS 0.3%CVE-2026-25500MEDIUMRack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor hrefEPSS 0.3%CVE-2026-102626HIGHLimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attributeEPSS 0.3%CVE-2025-29011MEDIUMWordPress YouTube Simple Gallery plugin <= 2.2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-47786LOWEmlog vulnerable to Stored Cross-site ScriptingEPSS 0.3%CVE-2025-9119MEDIUMNetis WF2419 Wireless Settings index.htm cross site scriptingEPSS 0.3%CVE-2025-31591MEDIUMWordPress Exit Popup Free plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2022-50952MEDIUMBanco Guayaquil 8.0.0 Mobile iOS Cross-Site Scripting via Profile Name InputEPSS 0.3%CVE-2024-36367MEDIUMIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possibleEPSS 0.3%CVE-2025-25988MEDIUMCross Site Scripting vulnerability in hooskcms v.1.8 allows a remote attacker to cause a denial of service via the custom Link title parametEPSS 0.3%CVE-2026-5341MEDIUMNMR Strava activities <= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2025-63842MEDIUMA Cross-Site Scripting (XSS) vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user tEPSS 0.3%CVE-2024-50468MEDIUMWordPress Raptor Editor plugin <= 1.0.20 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2021-47834MEDIUMSchlix CMS 2.2.6-6 - 'title' Persistent Cross-Site Scripting (Authenticated)EPSS 0.3%CVE-2024-51572MEDIUMWordPress LH QR Codes plugin <= 1.06 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2012-20004MEDIUMK-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff ParameterEPSS 0.3%CVE-2026-116097MEDIUMCloudClassroom-PHP-Project addnewstudent.php cross site scriptingEPSS 0.3%CVE-2025-49242MEDIUMWordPress Bellows Accordion Menu plugin <= 1.4.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-49244MEDIUMWordPress Shortcodes Ultimate plugin <= 7.3.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-48237MEDIUMWordPress Wishlist for WooCommerce plugin <= 3.2.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%