Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-36374MEDIUMIn JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possibleEPSS 0.3%CVE-2025-55580MEDIUMSolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module. An authenticated attacker can iEPSS 0.3%CVE-2026-102774MEDIUMSureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post ContentEPSS 0.3%CVE-2024-9269MEDIUMRelogo <= 0.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-36369MEDIUMIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possibleEPSS 0.3%CVE-2026-1512MEDIUMEssential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box WidgetEPSS 0.3%CVE-2024-2163MEDIUMNinja Beaver Add-ons for Beaver Builder <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via WidgetsEPSS 0.3%CVE-2024-36363MEDIUMIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possibleEPSS 0.3%CVE-2024-11754MEDIUMBooking System Trafft <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-1526MEDIUMDethemeKit for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-87632MEDIUMCross-site scripting in SanitizerAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a craEPSS 0.3%CVE-2026-58657MEDIUMGrav - Stored CSS Injection via Markdown Image resize() ActionEPSS 0.3%CVE-2026-103309HIGHGPTranslate < 2.34.14 - Unauthenticated Stored XSS via REST API Translation StorageEPSS 0.3%CVE-2024-43317MEDIUMWordPress RegistrationMagic plugin <= 6.0.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-47449MEDIUMWordPress Meow Gallery plugin <= 5.2.7 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-58031NONEStored i18n XSS in Special:ApiSandbox when a deprecated module is selectedEPSS 0.3%CVE-2024-9694MEDIUMCMSMasters Elementor Addon <= 1.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.3%CVE-2026-58028NONEPretty-printed API output combined with centralauthtoken allows XSS with certain gadgetsEPSS 0.3%CVE-2024-3611MEDIUMToolbar Extras for Elementor & More – WordPress Admin Bar Enhanced <= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-4710MEDIUMUber Menu <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple ShortcodesEPSS 0.3%