Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-49270MEDIUMWordPress Smart Blocks plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2019-25386MEDIUMSmoothwall Express 3.1 'dmzholes.cgi' Cross-Site ScriptingEPSS 0.3%CVE-2024-37352MEDIUMCross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06EPSS 0.3%CVE-2024-57329MEDIUMHortusFox v3.9 contains a stored XSS vulnerability in the "Add Plant" function. The name input field does not sanitize or escape user inputsEPSS 0.3%CVE-2024-37348MEDIUMCross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06EPSS 0.3%CVE-2025-63026MEDIUMWordPress Grand Restaurant Theme Elements for Elementor plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-1236MEDIUMEnvira Gallery for WordPress <= 1.12.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'justified_gallery_theme' Parameter via REST APIEPSS 0.3%CVE-2024-51629MEDIUMWordPress Header Footer Composer for Elementor plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-27186MEDIUM[20240803] - Core - XSS in HTML Mail TemplatesEPSS 0.3%CVE-2024-37349MEDIUMCross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06EPSS 0.3%CVE-2024-51627MEDIUMWordPress Audio Comparison Lite plugin <= 3.4 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-107889MEDIUMKeycloak-services: keycloak-services: stored xss on login page via kcsanitize bypassEPSS 0.3%CVE-2024-40873MEDIUMXSS in Secure Access administrative consoleEPSS 0.3%CVE-2024-37347MEDIUMCross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06EPSS 0.3%CVE-2024-50418MEDIUMWordPress Time Slot plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-32734HIGHbaserCMS: Multiple vulnerabilities in baserCMSEPSS 0.3%CVE-2025-61638NONESanitizer::validateAttributes data-XSSEPSS 0.3%CVE-2025-6430MEDIUMContent-Disposition header ignored when a file is included in an embed or object tagEPSS 0.3%CVE-2025-30434MEDIUMThe issue was addressed with improved input sanitization. This issue is fixed in iOS 18.4 and iPadOS 18.4. Processing a maliciously crafted EPSS 0.3%CVE-2024-10847MEDIUMStorely <= 18 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%