Weaknesses of type CWE-79

28,971 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-41169MEDIUMImproper Neutralization HTML tags in sulu/suluEPSS 0.6%CVE-2024-0386HIGHweForms <= 1.6.21 - Unauthenticated Stored Cross-Site Scripting via RefererEPSS 0.6%CVE-2020-36653LOWGENI Portal error-text.php cross site scriptingEPSS 0.6%CVE-2022-2114—Data Tables Generator by Supsystic < 1.10.20 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2025-53533MEDIUMPi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error pageEPSS 0.6%CVE-2021-24255—Essential Addons for Elementor < 4.5.4 - Contributor+ Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2021-24539—Coming Soon, Under Construction & Maintenance Mode By Dazzler < 1.6.7 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-24273—Clever Addons for Elementor < 2.1.0 - Contributor+ Stored XSSEPSS 0.6%CVE-2021-24268—JetWidgets For Elementor < 1.0.9 - Contributor+ Stored XSSEPSS 0.6%CVE-2024-4517LOWCampcodes Complete Web-Based School Management System teacher_salary_invoice1.php cross site scriptingEPSS 0.6%CVE-2021-24264—Image Hover Effects - Elementor Addon < 1.3.4 - Contributor+ Stored XSSEPSS 0.6%CVE-2023-42343MEDIUMA Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.EPSS 0.6%CVE-2021-24256—Elementor - Header, Footer & Blocks Template < 1.5.8 - Contributor+ Stored XSSEPSS 0.6%CVE-2022-2769LOWSourceCodester Company Website CMS contact cross site scriptingEPSS 0.6%CVE-2021-24257—Premium Addons for Elementor < 4.2.8 - Contributor+ Stored Cross-Site Scripting (XSS)EPSS 0.6%CVE-2022-3573MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 beforeEPSS 0.6%CVE-2021-24266—The Plus Addons for Elementor Page Builder Lite < 2.0.6 - Contributor+ Stored XSSEPSS 0.6%CVE-2021-36094MEDIUMXSS attack in appointment edit popup screenEPSS 0.6%CVE-2021-41261HIGHStored Cross-site Scripting in GaletteEPSS 0.6%CVE-2021-24259—Elementor Addon Elements < 1.11.2 - Contributor+ Stored XSSEPSS 0.6%