Weaknesses of type CWE-79

29,286 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-11196MEDIUMMulti-column Tag Map <= 17.0.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via mctagmap ShortcodeEPSS 0.5%CVE-2022-46058MEDIUMAeroCMS v0.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers toEPSS 0.5%CVE-2026-34569CRITICALCI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.5%CVE-2026-34560CRITICALCI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.5%CVE-2025-62780LOWchangedetection.io vulnerable to stored XSS in Watch update via APIEPSS 0.5%CVE-2024-2117MEDIUMElementor Website Builder – More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path WidgetEPSS 0.5%CVE-2022-1075LOWCollege Website Management System Contact cross site scriptingEPSS 0.5%CVE-2023-22638MEDIUMSeveral improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9EPSS 0.5%CVE-2026-25640HIGHPydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URLEPSS 0.5%CVE-2024-6848MEDIUMPost and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.26.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via File UploadEPSS 0.5%CVE-2024-3402MEDIUMStored XSS vulnerability in gaizhenbiao/chuanhuchatgptEPSS 0.5%CVE-2023-3080HIGHWP Mail Catcher <= 2.1.2 - Unauthenticated Stored Cross-Site Scripting via Email SubjectEPSS 0.5%CVE-2023-44310CRITICALStored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 throEPSS 0.5%CVE-2022-2645LOWSourceCodester Garage Management System edituser.php cross site scriptingEPSS 0.5%CVE-2023-3168HIGHWP Reroute Email <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via Email SubjectEPSS 0.5%CVE-2021-37781MEDIUMEmployee Record Management System v 1.2 is vulnerable to Cross Site Scripting (XSS) via editempprofile.php.EPSS 0.5%CVE-2023-3122HIGHGD Mail Queue <= 3.9.3 - Unauthenticated Stored Cross-Site Scripting via EmailEPSS 0.5%CVE-2024-2967MEDIUMGuest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor <= 4.4.7 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-47878HIGHReflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)EPSS 0.5%CVE-2021-23287MEDIUMSecurity issues in Intelligent Power Manager (IPM 1)EPSS 0.5%