Weaknesses of type CWE-79

30,305 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-63417HIGHA Stored Cross-Site Scripting (XSS) vulnerability in the chat functionality of the SelfBest platform 2023.3 allows authenticated attackers tEPSS 0.2%CVE-2024-13577MEDIUMCATS Job Listings <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-9344MEDIUMUsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2024-4419MEDIUMFetch JFT <= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2024-13455MEDIUMigumbi Online Booking <= 1.40 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-3901MEDIUMBootstrap Site Alert - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-042EPSS 0.2%CVE-2024-39923MEDIUMAn issue was discovered in Mahara 24.04 before 24.04.2 and 23.04 before 23.04.7. The About, Contact, and Help footer links can be set up to EPSS 0.2%CVE-2026-24973HIGHWordPress CitiLights theme <= 3.7.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-13582MEDIUMSimple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) <= 1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2024-13549MEDIUMAll Bootstrap Blocks <= 1.3.26 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-70891MEDIUMA stored cross-site scripting (XSS) vulnerability exists in Phpgurukul Cyber Cafe Management System v1.0 within the user management module. EPSS 0.2%CVE-2025-8619MEDIUMOSM Map Widget for Elementor <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URLEPSS 0.2%CVE-2025-5123MEDIUMContact Us Page – Contact People <= 3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via style ParameterEPSS 0.2%CVE-2025-13731MEDIUMNexter Extension <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%CVE-2024-13579MEDIUMWP-Asambleas <= 2.85.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-5540MEDIUMEvent RSVP and Simple Event Management Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-2222MEDIUMcode-projects Online Reviewer System btn_functions.php cross site scriptingEPSS 0.2%CVE-2025-49053MEDIUMWordPress WP Airdrop Manager plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-13751MEDIUM3D Photo Gallery <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-14722MEDIUMvion707 DMadmin Backend AddonsController.class.php add cross site scriptingEPSS 0.2%