Weaknesses of type CWE-79

30,301 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-33975HIGHCross-site Scripting in Janobe E-Negosyo SystemEPSS 0.3%CVE-2025-65675MEDIUMStored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via craftEPSS 0.3%CVE-2025-64027MEDIUMSnipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV EPSS 0.3%CVE-2024-38697MEDIUMWordPress Goftino plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-11876MEDIUMKredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site <= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-56019MEDIUMWordPress Inline Footnotes Plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-0598HIGHStored Cross-site Scripting (XSS) vulnerability affecting Relations in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2026-85229MEDIUMApache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057)EPSS 0.3%CVE-2024-6179MEDIUMXSS vulnerability in LG SuperSign CMSEPSS 0.3%CVE-2026-89427MEDIUMAd Inserter <= 2.8.18 - Reflected Cross-Site Scripting via 's' Search ParameterEPSS 0.3%CVE-2026-10857MEDIUMReflected XSS in Akinsoft's e-CommerceEPSS 0.3%CVE-2026-1025MEDIUMMultiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration AgentEPSS 0.3%CVE-2024-49255MEDIUMWordPress Da Reactions plugin <= 5.1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-43278MEDIUMWordPress Meta Field Block plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-54683MEDIUMWordPress WP Modal Popup with Cookie Integration Plugin plugin <= 2.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-75307MEDIUMzhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpoint.EPSS 0.3%CVE-2025-8567MEDIUMNexter Blocks <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.3%CVE-2025-5488MEDIUMWP Masonry & Infinite Scroll <= 2.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-7957MEDIUMShortcodeHub <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via author_link_target ParameterEPSS 0.3%CVE-2024-34766MEDIUMWordPress ChaosTheory theme <= 1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%