Weaknesses of type CWE-79

30,301 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-12499MEDIUMWP jQuery DataTable <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-85227MEDIUMReflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes ParametersEPSS 0.3%CVE-2025-8451MEDIUMEssential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items'EPSS 0.3%CVE-2026-13234MEDIUMAI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054EPSS 0.3%CVE-2026-10082MEDIUMAdvanced Ads – Ad Manager & AdSense < 2.0.23 - Contributor+ Stored XSS via the_ad Shortcode 'ad_args' ParameterEPSS 0.3%CVE-2024-33992HIGHCross-Site Scripting (XSS) vulnerability in Janobe School Event Management SystemEPSS 0.3%CVE-2024-51614MEDIUMWordPress Aajoda Testimonials plugin <= 2.2.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-15678MEDIUMNexter Blocks < 5.0.2 - Author+ Stored XSS via SVG UploadEPSS 0.3%CVE-2025-0596HIGHStored Cross-site Scripting (XSS) vulnerability affecting Bookmark Editor in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2026-13231MEDIUMAdvanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051EPSS 0.3%CVE-2026-12869MEDIUMHeader Footer Builder for Elementor < 1.2.1 - Contributor+ Stored XSS via Template ImportEPSS 0.3%CVE-2026-65882MEDIUMJoomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1EPSS 0.3%CVE-2026-19727MEDIUMHTML Injection via Improper Input Sanitization in Yordam Informatics's Library Automation SystemEPSS 0.3%CVE-2024-43305MEDIUMWordPress Custom Layouts – Post + Product grids made easy plugin <= 1.4.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-9939MEDIUMCodeAstro Real Estate Management System propertyview.php cross site scriptingEPSS 0.3%CVE-2024-54675MEDIUMapp/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow.EPSS 0.3%CVE-2026-81918MEDIUMConcrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display blockEPSS 0.3%CVE-2026-16638MEDIUMMedia Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080EPSS 0.3%CVE-2024-43113MEDIUMThe contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129EPSS 0.3%CVE-2024-38750MEDIUMWordPress Advanced post slider plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%