Weaknesses of type CWE-79

29,250 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-51380HIGHStored Cross-Site Scripting (XSS) vulnerability discovered in the Properties Component of JATOS v3.9.3. This flaw allows an attacker to injeEPSS 0.5%CVE-2023-0301MEDIUMCross-site Scripting (XSS) - Stored in alfio-event/alf.ioEPSS 0.5%CVE-2023-20104MEDIUMCisco Webex App for Web Cross-Site Scripting VulnerabilityEPSS 0.5%CVE-2023-33991HIGHStored Cross-Site Scripting (Stored XSS) vulnerability in SAP UI5 Variant ManagementEPSS 0.5%CVE-2025-2377MEDIUMSourceCodester Vehicle Management System confirmbooking.php cross site scriptingEPSS 0.5%CVE-2025-4379MEDIUMReflected XSS in DobryCMSEPSS 0.5%CVE-2024-0442MEDIUMRoyal Elementor Addons and Templates <= 1.3.87 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2026-85129HIGHHoo Companion 1.0.2 - Unauthenticated Stored XSS via Theme Settings ImportEPSS 0.5%CVE-2025-4779CRITICALStored Cross-site Scripting (XSS) in lunary-ai/lunaryEPSS 0.5%CVE-2024-1196MEDIUMSourceCodester Testimonial Page Manager HTTP POST Request add-testimonial.php cross site scriptingEPSS 0.5%CVE-2023-44389LOWZope management interface vulnerable to stored cross site scripting via the title propertyEPSS 0.5%CVE-2025-62694MEDIUMStored XSS through a system messageEPSS 0.5%CVE-2023-6225MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-8873MEDIUMPeproDev WooCommerce Receipt Uploader <= 2.6.9 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2023-22252MEDIUMAEM Reflected XSS Arbitrary code executionEPSS 0.5%CVE-2024-4203MEDIUMPremium Addons for Elementor <= 4.10.30 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2023-21615MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.5%CVE-2023-21616MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.5%CVE-2023-6591MEDIUMPopup Box Pro < 20.9.0 - Admin+ Stored XSSEPSS 0.5%CVE-2024-7303MEDIUMitsourcecode Online Blood Bank Management System Send Blood Request Page request.php cross site scriptingEPSS 0.5%