Weaknesses of type CWE-79

29,319 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-3294HIGHCross-site Scripting (XSS) - DOM in saleor/react-storefrontEPSS 0.5%CVE-2024-37673MEDIUMCross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via EPSS 0.5%CVE-2024-22635MEDIUMWebCalendar v1.3.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /WebCalendarvqsmnseug2/eEPSS 0.5%CVE-2026-5255MEDIUMcode-projects Simple Laundry System Parameter delstaffinfo.php cross site scriptingEPSS 0.5%CVE-2023-50376HIGHWordPress Simple Membership Plugin <= 4.3.8 is vulnerable to Unauth. Reflected Cross Site Scripting (XSS)EPSS 0.5%CVE-2024-37145MEDIUMGHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/idEPSS 0.5%CVE-2026-4849MEDIUMcode-projects Simple Laundry System Parameter modify.php cross site scriptingEPSS 0.5%CVE-2024-2665MEDIUMPremium Addons for Elementor <= 4.10.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via ButtonEPSS 0.5%CVE-2024-53273MEDIUMGHSL-2024-110: Reflected XSS in /register in habiticaEPSS 0.5%CVE-2024-37671MEDIUMCross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via EPSS 0.5%CVE-2024-9635MEDIUMCheckout with Cash App on WooCommerce <= 6.0.2 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2024-56915MEDIUMNetbox Community v4.1.7 and fixed in v.4.2.2 is vulnerable to Cross Site Scripting (XSS) via the RSS feed widget.EPSS 0.5%CVE-2023-34008HIGHWordPress WP ERP Plugin <= 1.12.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2023-29837MEDIUMCross Site Scripting vulnerability found in Exelysis Unified Communication Solution (EUCS) v.1.0 allows a remote attacker to gain privilegesEPSS 0.5%CVE-2026-25868MEDIUMMiniGal Nano <= 0.3.5 Reflected XSS via dir ParameterEPSS 0.5%CVE-2023-1805MEDIUMProduct Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSSEPSS 0.5%CVE-2023-34022HIGHWordPress Dynamic QR Code Generator Plugin <= 0.0.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2026-32940CRITICALSiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)EPSS 0.5%CVE-2024-51735HIGHStored Cross-site Scripting to RCE on Osmedeus Web ServerEPSS 0.5%CVE-2024-11330MEDIUMCustom CSS, JS & PHP <= 2.3.0 - Reflected Cross-Site ScriptingEPSS 0.5%