Weaknesses of type CWE-79

29,112 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-0602MEDIUMYet Another Related Posts Plugin (YARPP) <= 5.30.9 - Authenticated(Administrator+) Stored Cross-Site Scripting via settingsEPSS 0.5%CVE-2024-53963MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.5%CVE-2022-37338MEDIUMWordPress Blossom Recipe Maker plugin <= 1.0.7 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.5%CVE-2024-41239MEDIUMA Stored Cross Site Scripting (XSS) vulnerability was found in "/smsa/add_class_submit.php" in Responsive School Management System v3.2.0, wEPSS 0.5%CVE-2022-4821LOWFlatPress XML File Handler/MD File admin.uploader.php onupload cross site scriptingEPSS 0.5%CVE-2026-30977LOWRenderBlocking has Stored XSS in renderblocking-css with Inline Assets modeEPSS 0.5%CVE-2025-4611MEDIUMSlim SEO <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via slim_seo_breadcrumbs ShortcodeEPSS 0.5%CVE-2024-53965MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.5%CVE-2024-1894MEDIUMBurst Statistics – Privacy-Friendly Analytics for WordPress <= 1.5.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via burst_total_pageviews_countEPSS 0.5%CVE-2010-10004LOWInformation Cards Module cross site scriptingEPSS 0.5%CVE-2022-4822LOWFlatPress Setup main.lib.php cross site scriptingEPSS 0.5%CVE-2023-28604MEDIUMThe fluid_components (aka Fluid Components) extension before 3.5.0 for TYPO3 allows XSS via a component argument parameter, for certain {conEPSS 0.5%CVE-2024-4644LOWSourceCodester Prison Management System changepassword.php cross site scriptingEPSS 0.5%CVE-2021-4303LOWshannah Xataface Installer install_form.js.php testftp cross site scriptingEPSS 0.5%CVE-2026-23794MEDIUMApache Syncope: Reflected XSS on Enduser LoginEPSS 0.5%CVE-2022-35294—An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is tEPSS 0.5%CVE-2023-7057LOWcode-projects Faculty Management System yearlevel.php cross site scriptingEPSS 0.5%CVE-2024-1296MEDIUMBrizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2014-125031LOWkirill2485 TekNet loggedin.php cross site scriptingEPSS 0.5%CVE-2022-40373MEDIUMCross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file.EPSS 0.5%