Weaknesses of type CWE-79

29,359 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-7343MEDIUMBaidu UEditor cross site scriptingEPSS 0.5%CVE-2026-54221MEDIUMReflected XSS in UBB.threadsEPSS 0.5%CVE-2022-36778MEDIUMSynel - eHarmony Stored XSSEPSS 0.5%CVE-2024-3554MEDIUMAll in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2026-21361HIGHAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.5%CVE-2024-4327LOWApryse WebViewer PDF Document cross site scriptingEPSS 0.5%CVE-2025-6551MEDIUMjava-aodeng Hope-Boot WebController.java login cross site scriptingEPSS 0.5%CVE-2024-8499MEDIUMCheckout Field Editor (Checkout Manager) for WooCommerce <= 2.0.3 - Reflected Cross-Site Scripting via render_review_request_noticeEPSS 0.5%CVE-2024-12469MEDIUMWP BASE Booking of Appointments, Services and Events <= 4.9.1 - Reflected Cross-Site Scripting via status ParameterEPSS 0.5%CVE-2023-37259MEDIUMCross site scripting in Export Chat featureEPSS 0.5%CVE-2024-2655MEDIUMElementor Addons by Livemesh <= 8.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display NameEPSS 0.5%CVE-2024-11810MEDIUMPayGreen Payment Gateway <= 1.0.26 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2024-9279MEDIUMfunnyzpc Mee-Admin User Center index cross site scriptingEPSS 0.5%CVE-2024-9225MEDIUMSEOPress – On-site SEO <= 8.1.1 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2023-3653MEDIUMStored XSS in Digital Ant E-Commerce SoftwareEPSS 0.5%CVE-2023-36688MEDIUMWordPress Simple Site Verify Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.5%CVE-2023-41791HIGHLack of Authorization and Stored XSS Via Translation AbuseEPSS 0.5%CVE-2022-45598MEDIUMCross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via improper santization.EPSS 0.5%CVE-2022-44261MEDIUMAvery Dennison Monarch Printer M9855 is vulnerable to Cross Site Scripting (XSS).EPSS 0.5%CVE-2026-102147CRITICALKiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)EPSS 0.5%