Weaknesses of type CWE-79

29,251 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-2391LOWEVE-NG Lab cross site scriptingEPSS 0.5%CVE-2024-7945MEDIUMitsourcecode Laravel Property Management System Notes Page create cross site scriptingEPSS 0.5%CVE-2024-2479LOWMHA Sistemas arMHAzena Cadastro Page cross site scriptingEPSS 0.5%CVE-2022-28612MEDIUMWordPress Custom Popup Builder plugin <= 1.3.1 - Improper Access Control vulnerability leading to multiple Authenticated Stored XSSEPSS 0.5%CVE-2023-2340MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.5%CVE-2023-6600HIGHOMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 5.7.9 - Missing Authorization to Unauthenticated Directory Deletion and Cross-Site ScriptingEPSS 0.5%CVE-2024-1397MEDIUMHT Mega <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleTagEPSS 0.5%CVE-2023-3196MEDIUMMultiple vulnerabilities in Canopsis of CapensisEPSS 0.5%CVE-2023-4564MEDIUMMultiple vulnerabilities in Canopsis of CapensisEPSS 0.5%CVE-2023-5638MEDIUMBooster for WooCommerce <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2022-46128MEDIUMphpgurukul Doctor Appointment Management System V 1.0.0 is vulnerable to Cross Site Scripting (XSS) via searchdata=.EPSS 0.5%CVE-2026-16627HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.5%CVE-2021-38728MEDIUMSEMCMS SHOP v 1.1 is vulnerable to Cross Site Scripting (XSS) via Ant_M_Coup.php.EPSS 0.5%CVE-2024-45123MEDIUMAdobe Commerce | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.5%CVE-2025-25187HIGHCross-site Scripting in Goto Anything allows arbitrary code execution in JoplinEPSS 0.5%CVE-2026-31845CRITICALRukovoditel CRM Reflected XSS via zd_echo Parameter in Zadarma Telephony API EndpointEPSS 0.5%CVE-2024-7247MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Gallery and Countdown WidgetsEPSS 0.5%CVE-2024-7844MEDIUMSourceCodester Online Graduate Tracer System add_acc.php cross site scriptingEPSS 0.5%CVE-2023-51281MEDIUMCross Site Scripting vulnerability in Customer Support System v.1.0 allows a remote attacker to escalate privileges via a crafted script firEPSS 0.5%CVE-2024-33528MEDIUMA Stored Cross-site Scripting (XSS) vulnerability in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with EPSS 0.5%