Weaknesses of type CWE-79

29,306 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-52526MEDIUMLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/services.inc.phpEPSS 0.5%CVE-2023-5470MEDIUMEtsy Shop <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2024-34089HIGHAn issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. A remote authenticaEPSS 0.5%CVE-2026-15346MEDIUMVikBooking Hotel Booking Engine & PMS <= 1.8.13 - Reflected Cross-Site Scripting via 'category_id' ParameterEPSS 0.5%CVE-2025-3533MEDIUMYouDianCMS index.html.Attackers cross site scriptingEPSS 0.5%CVE-2024-4216HIGHXSS vulnerability in /settings/store API response json payload in pgAdmin 4EPSS 0.5%CVE-2023-44311CRITICALMultiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class iEPSS 0.5%CVE-2024-33371MEDIUMCross Site Scripting vulnerability in DedeCMS v.5.7.113 allows a remote attacker to execute arbitrary code via the typeid parameter in the mEPSS 0.5%CVE-2026-25734MEDIUMRucio WebUI has Stored Cross-site Scripting (XSS) in RSE MetadataEPSS 0.5%CVE-2026-18478MEDIUMStored XSS in Magnolia CMSEPSS 0.5%CVE-2022-2365MEDIUMCross-site Scripting (XSS) - Stored in zadam/triliumEPSS 0.5%CVE-2022-40606MEDIUMMITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability thEPSS 0.5%CVE-2024-47536MEDIUMstarcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" fieldEPSS 0.5%CVE-2025-32015MEDIUMFreshRSS vulnerable to Cross-site Scripting by embedding <script> tag inside <iframe srcdoc>EPSS 0.5%CVE-2026-64851HIGHGrav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlersEPSS 0.5%CVE-2026-21290HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2024-24041MEDIUMA stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute arEPSS 0.5%CVE-2024-41665MEDIUMAmpache Stored Cross-site Scripting VulnerabilityEPSS 0.5%CVE-2022-40605MEDIUMMITRE CALDERA before 4.1.0 allows XSS in the Operations tab and/or Debrief plugin via a crafted operation name, a different vulnerability thEPSS 0.5%CVE-2023-42497CRITICALReflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and LiferaEPSS 0.5%