Weaknesses of type CWE-79

29,496 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-0363MEDIUMScheduled Announcements Widget < 1.0 - Contributor+ Stored XSSEPSS 0.4%CVE-2026-73156MEDIUMcti-transmute Sunburst and Treemap Tooltips Allow Cross-Site Scripting via Crafted Conversion DataEPSS 0.4%CVE-2026-40872CRITICALmailcow: dockerized vulnerable to stored XSS in autodiscover logs email address fieldEPSS 0.4%CVE-2026-75529MEDIUMStored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of PandoraEPSS 0.4%CVE-2011-10036MEDIUMNagios XI < 2011R1.9 XSS via backend_url JavaScript Link HandlerEPSS 0.4%CVE-2023-0542MEDIUMCustom Post Type List Shortcode <= 1.4.4 - Contributor+ Stored XSSEPSS 0.4%CVE-2011-10040MEDIUMNagios XI < 2011R1.9 XSS via Status/Report Page Link FunctionsEPSS 0.4%CVE-2022-44153MEDIUMRapid Software LLC Rapid SCADA 5.8.4 is vulnerable to Cross Site Scripting (XSS).EPSS 0.4%CVE-2023-29015MEDIUMGoobi viewer Core has Cross-Site Scripting Vulnerability in User Comments EPSS 0.4%CVE-2024-9083MEDIUMSourceCodester Employee Management System add-admin.php cross site scriptingEPSS 0.4%CVE-2025-24735HIGHWordPress Chatra Live Chat + ChatBot + Cart Saver plugin <= 1.0.11 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2024-1282MEDIUMEmail Encoder – Protect Email Addresses and Phone Numbers <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-31544MEDIUMA stored cross-site scripting (XSS) vulnerability in Computer Laboratory Management System v1.0 allows attackers to execute arbitrary JavaScEPSS 0.4%CVE-2024-24035MEDIUMCross Site Scripting (XSS) vulnerability in Setor Informatica SIL 3.1 allows attackers to run arbitrary code via the hmessage parameter.EPSS 0.4%CVE-2026-105288MEDIUMfeelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scriptingEPSS 0.4%CVE-2018-17883MEDIUMAn issue was discovered in Open Ticket Request System (OTRS) 6.0.x before 6.0.12. An attacker could send an e-mail message with a malicious EPSS 0.4%CVE-2023-26912MEDIUMCross site scripting (XSS) vulnerability in xenv S-mall-ssm thru commit 3d9e77f7d80289a30f67aaba1ae73e375d33ef71 on Feb 17, 2020, allows locEPSS 0.4%CVE-2024-8546MEDIUMElementsKit Elementor addons <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video WidgetEPSS 0.4%CVE-2023-0736MEDIUMCross-site Scripting (XSS) - Stored in wallabag/wallabagEPSS 0.4%CVE-2022-40011MEDIUMTypora through 1.3.8 allows XSS if a document containing an SVG element with an attacker-controlled onload attribute is exported and then usEPSS 0.4%