Weaknesses of type CWE-79

29,496 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-11815MEDIUMPósturinn\'s Shipping with WooCommerce <= 1.3.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-105288MEDIUMfeelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scriptingEPSS 0.4%CVE-2023-26465HIGHPega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.EPSS 0.4%CVE-2023-29015MEDIUMGoobi viewer Core has Cross-Site Scripting Vulnerability in User Comments EPSS 0.4%CVE-2023-3965MEDIUMnsc <= 1.0 - Prototype Pollution to Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-9083MEDIUMSourceCodester Employee Management System add-admin.php cross site scriptingEPSS 0.4%CVE-2023-29014MEDIUMGoobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID ParameterEPSS 0.4%CVE-2024-25876MEDIUMA cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HEPSS 0.4%CVE-2023-3167HIGHMail Queue <= 1.1 - Unauthenticated Stored Cross-Site Scripting via Email SubjectEPSS 0.4%CVE-2024-24050MEDIUMCross Site Scripting (XSS) vulnerability in Sourcecodester Workout Journal App 1.0 allows attackers to run arbitrary code via parameters firEPSS 0.4%CVE-2024-1500MEDIUMRoyal Elementor Addons and Templates <= 1.3.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Logo WidgetEPSS 0.4%CVE-2023-49077HIGHmailcow-dockerized XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data ManipulationEPSS 0.4%CVE-2022-31037MEDIUMOroCommerce vulnerable to Cross-site Scripting via Shipping rule editing pageEPSS 0.4%CVE-2025-55321CRITICALAzure Monitor Log Analytics Spoofing VulnerabilityEPSS 0.4%CVE-2026-53641MEDIUMFOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literalEPSS 0.4%CVE-2024-4324MEDIUMWP Video Lightbox <= 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via width ParameterEPSS 0.4%CVE-2023-29016MEDIUMGoobi viewer Core has Cross-Site Scripting Vulnerability in User NicknamesEPSS 0.4%CVE-2023-3962MEDIUMWinters <= 1.4.3 - Prototype Pollution to Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-25436MEDIUMA cross-site scripting (XSS) vulnerability in the Production module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTMEPSS 0.4%CVE-2023-3933MEDIUMYour Journey <= 1.9.8 - Prototype Pollution to Reflected Cross-Site ScriptingEPSS 0.4%