Weaknesses of type CWE-79

29,487 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-40986MEDIUMReflected Cross-Site Scripting in PideTuCitaEPSS 0.4%CVE-2024-11231MEDIUM우커머스 네이버페이 <= 3.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via mnp_purchase ShortcodeEPSS 0.4%CVE-2023-28083HIGHPotential Cross-Site scripting vulnerability in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4). EPSS 0.4%CVE-2023-5110MEDIUMBSK PDF Manager <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-6961HIGHWP Meta SEO <= 4.5.12 - Unauthenticated Stored Cross-Site Scripting via Referer headerEPSS 0.4%CVE-2024-12339MEDIUMDigihood HTML Sitemap <= 3.1.1 - Reflected Cross-Site Scripting via 'channel'EPSS 0.4%CVE-2024-8172MEDIUMSourceCodester QR Code Attendance System delete-student.php cross site scriptingEPSS 0.4%CVE-2026-47665HIGHPenpot: Stored XSS via comment content, innerHTML renders unsanitized HTMLEPSS 0.4%CVE-2022-2059LOWStored Cross Site-Scripting in Agent ManagerEPSS 0.4%CVE-2024-23659MEDIUMSPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is related to javascript/bigup.js and javascriptEPSS 0.4%CVE-2024-13069MEDIUMSourceCodester Multi Role Login System add-user.php cross site scriptingEPSS 0.4%CVE-2024-47885MEDIUMastro's client-side router has DOM Clobbering Gadget that leads to XSSEPSS 0.4%CVE-2023-5413MEDIUMImage horizontal reel scroll slideshow <= 13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-34245HIGHCross site scripting (XSS) in @udecode/plate-linkEPSS 0.4%CVE-2025-22294HIGHWordPress Custom Field For WP Job Manager plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-0900MEDIUMCross-Site Scripting Vulnerability in DivvyDriveEPSS 0.4%CVE-2022-40963MEDIUMWordPress WP Page Builder plugin <= 1.2.6 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilitiesEPSS 0.4%CVE-2024-11366MEDIUMSEO Landing Page Generator <= 1.66.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-57427MEDIUMPHPJabbers Cinema Booking System v2.0 is vulnerable to reflected cross-site scripting (XSS). Multiple endpoints improperly handle user inputEPSS 0.4%CVE-2026-34241HIGHCtrlPanel: Stored XSS in Ticket Reply Notifications Allows Session HijackingEPSS 0.4%