Weaknesses of type CWE-79

29,079 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-33942MEDIUMCross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and LiferaEPSS 0.5%CVE-2021-32859MEDIUMBaremetrics date range picker vulnerable to Cross-site ScriptingEPSS 0.5%CVE-2025-8349MEDIUMCross-Site Scripting (XSS) stored in Tawk Live ChatEPSS 0.5%CVE-2022-32407MEDIUMSoftr v2.0 was discovered to contain a Cross-Site Scripting (XSS) vulnerability via the First Name parameter under the Create A New Account EPSS 0.5%CVE-2024-1541MEDIUMGutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-53864MEDIUMCross-site Scripting in a field that is used in the Content name pattern in ibexa/admin-uiEPSS 0.5%CVE-2023-5864HIGHCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.5%CVE-2024-1497MEDIUMOrbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via form widget addr2_width attributeEPSS 0.5%CVE-2021-23225—Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the "new_username" field EPSS 0.5%CVE-2024-0700MEDIUMSimple Tweet <= 1.4.0.2 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-46367CRITICALA Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to inject arbitrary JavaScript code by EPSS 0.5%CVE-2024-1074MEDIUMBeaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Audio WidgetEPSS 0.5%CVE-2025-1517MEDIUMSina Extension for Elementor <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text, Countdown Widget, and Login Form ShortcodesEPSS 0.5%CVE-2024-7900MEDIUMxiaohe4966 TpMeCMS Basic Configuration config cross site scriptingEPSS 0.5%CVE-2023-1757HIGHCross-site Scripting (XSS) - Stored in thorsten/phpmyfaqEPSS 0.5%CVE-2023-1148MEDIUMCross-site Scripting (XSS) - Stored in flatpressblog/flatpressEPSS 0.5%CVE-2024-1499MEDIUMOrbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2023-3387MEDIUMLana Text to Image <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2024-47093HIGHFix various XSS issues and potential RCEEPSS 0.5%CVE-2022-37330MEDIUMWordPress WHA Crossword plugin <= 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.5%