Weaknesses of type CWE-79

28,807 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-61492LOWIn JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possibleEPSS 0.7%CVE-2023-5660MEDIUMSendPress Newsletters <= 1.22.3.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.7%CVE-2024-10385HIGHStored XSS in DirectAdmin Evo SkinEPSS 0.7%CVE-2021-4103MEDIUMCross-site Scripting (XSS) - Stored in vanessa219/vditorEPSS 0.7%CVE-2022-31063MEDIUMCross site scripting via the title of a document in TuleapEPSS 0.7%CVE-2022-40358MEDIUMAn issue was discovered in AjaXplorer 4.2.3, allows attackers to cause cross site scripting vulnerabilities via a crafted svg file upload.EPSS 0.7%CVE-2021-24267—All-in-One Addons for Elementor - WidgetKit < 2.3.10 - Contributor+ Stored XSSEPSS 0.7%CVE-2023-29839MEDIUMA Stored Cross Site Scripting (XSS) vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution ofEPSS 0.7%CVE-2026-40171HIGHJupyter Notebook and JupyterLab token theft via stored XSS in help command linkerEPSS 0.7%CVE-2024-29504HIGHCross Site Scripting vulnerability in Summernote v.0.8.18 and before allows a remote attacker to execute arbtirary code via a crafted payloaEPSS 0.7%CVE-2024-35694HIGHWordPress WPMobile.App plugin <= 11.41 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.7%CVE-2021-24260—Livemesh Addons for Elementor < 6.8 - Contributor+ Stored XSSEPSS 0.7%CVE-2023-2389LOWNetgear SRX5308 Web Management Interface cross site scriptingEPSS 0.7%CVE-2022-30304MEDIUMAn improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.EPSS 0.7%CVE-2021-24261—HT Mega - Absolute Addons for Elementor Page Builder < 1.5.7 - Contributor+ Stored XSSEPSS 0.7%CVE-2024-40484MEDIUMA Reflected Cross Site Scripting (XSS) vulnerability was found in "/oahms/search.php" in PHPGurukul Old Age Home Management System v1.0, whiEPSS 0.7%CVE-2021-24263—PowerPack Addons for Elementor < 2.3.2 - Contributor+ Stored XSSEPSS 0.7%CVE-2023-2383LOWNetgear SRX5308 Web Management Interface cross site scriptingEPSS 0.7%CVE-2023-2390LOWNetgear SRX5308 Web Management Interface cross site scriptingEPSS 0.7%CVE-2022-3148MEDIUMCross-site Scripting (XSS) - Generic in jgraph/drawioEPSS 0.7%