Weaknesses of type CWE-79

29,139 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-3167MEDIUMOcean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2026-9148HIGHComments <= 7.6.56 - Unauthenticated Stored Cross-Site Scripting via 'Website' FieldEPSS 0.5%CVE-2026-7330HIGHAuto Affiliate Links <= 6.8.8 - Unauthenticated Stored Cross-Site Scripting via 'url' ParameterEPSS 0.5%CVE-2023-26998MEDIUMCross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the creator paEPSS 0.5%CVE-2026-83561HIGHComplianz GDPR/CCPA Cookie Consent Banner <= 7.5.4 - Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker RegexEPSS 0.5%CVE-2024-4104MEDIUMADFO – Custom data in admin dashboard <= 1.9.0 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2023-30106MEDIUMSourcecodester Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS) via page=about.EPSS 0.5%CVE-2023-2219LOWSourceCodester Task Reminder System Users.php cross site scriptingEPSS 0.5%CVE-2025-0844MEDIUMneedyamin Library Card System Registration Page signup.php cross site scriptingEPSS 0.5%CVE-2022-4667MEDIUMRSS Aggregator by Feedzy < 4.1.1 - Contributor+ Stored XSSEPSS 0.5%CVE-2025-66472MEDIUMXWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplicationEPSS 0.5%CVE-2024-55342MEDIUMA file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media. This PEPSS 0.5%CVE-2024-45060HIGHUnauthenticated Cross-Site-Scripting (XSS) in sample file in PHPSpreadsheetEPSS 0.5%CVE-2022-40215LOWWordPress Tabs plugin <= 3.7.1 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.5%CVE-2025-43440MEDIUMThis issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, viEPSS 0.5%CVE-2023-5086MEDIUMCopy Anything to Clipboard <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2025-21612HIGHCross-site Scripting in TabberTransclude in Extension:TabberNeueEPSS 0.5%CVE-2024-4150MEDIUMSimple Basic Contact Form <= 20221201 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2023-33969MEDIUMStored Cross site scripting in the Task External Link Functionality in KanboardEPSS 0.5%CVE-2025-27793MEDIUMVega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]EPSS 0.5%