Weaknesses of type CWE-79

30,300 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-47625MEDIUMWordPress Enter Addons – Ultimate Template Builder for Elementor plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-12801MEDIUMUltra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider AttributesEPSS 0.3%CVE-2024-11339MEDIUMSmart PopUp Blaster <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-37265MEDIUMWordPress IdeaPush plugin <= 8.60 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-28154HIGHWordPress Samex and M.Anh WordPress themes affected by Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-54212MEDIUMWordPress Magical Addons For Elementor plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-12279MEDIUMcode-projects Client Details System welcome.php cross site scriptingEPSS 0.3%CVE-2026-21618HIGHCross-site scripting (XSS) in OAuth Device Authorization screenEPSS 0.3%CVE-2026-35539MEDIUMAn issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in prEPSS 0.3%CVE-2024-11903MEDIUMWP eCards <= 1.3.904 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-30557MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located iEPSS 0.3%CVE-2026-30560MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located iEPSS 0.3%CVE-2025-48875MEDIUMFreeScout Vulnerable to Stored XSSEPSS 0.3%CVE-2024-35351MEDIUMA vulnerability has been discovered in Diño Physics School Assistant version 2.3. This vulnerability impacts unidentified code within the fiEPSS 0.3%CVE-2026-2573MEDIUMGutenKit <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss'EPSS 0.3%CVE-2026-85575MEDIUMThe ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' ParameterEPSS 0.3%CVE-2023-50964MEDIUMIBM InfoSphere Information Server cross-site scriptingEPSS 0.3%CVE-2026-72787MEDIUMCraft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft NameEPSS 0.3%CVE-2024-58289MEDIUMMicroweber 2.0.15 Stored Cross-Site Scripting via User Profile FieldsEPSS 0.3%CVE-2024-35701MEDIUMWordPress PropertyHive plugin <= 2.0.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%