Weaknesses of type CWE-79

30,300 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-35284MEDIUMA vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to EPSS 0.3%CVE-2025-8073MEDIUMDynamic AJAX Product Filters for WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via name ParameterEPSS 0.3%CVE-2024-38785MEDIUMWordPress Gutenverse plugin <= 1.9.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-97735HIGHITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive overEPSS 0.3%CVE-2025-8208MEDIUMSpexo Addons for Elementor <= 1.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.3%CVE-2025-8580MEDIUMInappropriate implementation in Filesystems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a cEPSS 0.3%CVE-2026-97339HIGHComplianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker FilterEPSS 0.3%CVE-2024-34566MEDIUMWordPress Content Blocks (Custom Post Widget) plugin <= 3.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-35715MEDIUMWordPress Bloglo and Blogvi themes affected by Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-14221MEDIUMSourceCodester Online Banking System page cross site scriptingEPSS 0.3%CVE-2023-49573HIGHXSS vulnerability in VX Search EnterpriseEPSS 0.3%CVE-2026-2201MEDIUMZeroWdd studentmanager LeaveController.java addLeave cross site scriptingEPSS 0.3%CVE-2026-2432MEDIUMCM Custom Reports <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin LabelsEPSS 0.3%CVE-2025-52662MEDIUMA vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under EPSS 0.3%CVE-2024-51677MEDIUMWordPress Knowledge Base plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-9565MEDIUMBlocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe ShortcodeEPSS 0.3%CVE-2024-51578MEDIUMWordPress 3D Presentation plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-52422MEDIUMWordPress WP Githuber MD plugin <= 1.16.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-66470MEDIUMNiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG contentEPSS 0.3%CVE-2024-41587MEDIUMStored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.EPSS 0.3%