Weaknesses of type CWE-79

29,501 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-21731MEDIUM[20240703] - Core - XSS in StringHelper::truncate methodEPSS 0.4%CVE-2024-36210MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.4%CVE-2026-42197HIGHRELATE Vulnerable to Stored XSS via Unprivileged User ProfileEPSS 0.4%CVE-2024-43381MEDIUMreNgine vulnerable to Stored Cross-Site Scripting (XSS) via DNS Record PoisoningEPSS 0.4%CVE-2023-24401MEDIUMWordPress Mobile Call Now & Map Buttons Plugin <= 1.5.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-34417MEDIUMWordPress Viet Nam Affiliate plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-13506MEDIUMGeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name ParameterEPSS 0.4%CVE-2023-0868MEDIUMStealing Cookies using Reflected XSS via graph resultsEPSS 0.4%CVE-2025-53599CRITICALWhale browser for iOS before 3.9.1.4206 allow an attacker to execute malicious scripts in the browser via a crafted javascript scheme.EPSS 0.4%CVE-2023-35092MEDIUMWordPress breadcrumb simple Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-42704MEDIUMA cross-site scripting (XSS) vulnerability in Employee Service Center (esc) and Service Portal (sp) in ServiceNow Quebec, Rome, and San DiegEPSS 0.4%CVE-2023-35048MEDIUMWordPress Booking and Rental Manager Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-34430MEDIUMWordPress TT Custom Post Type Creator plugin <=1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-33950MEDIUMWordPress Archives Calendar Widget plugin <= 1.0.15 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-11850MEDIUMStored XSS in langgenius/difyEPSS 0.4%CVE-2023-0893MEDIUMTime Sheets < 1.29.3 - Admin+ Stored XSSEPSS 0.4%CVE-2024-6130MEDIUMForm Maker by 10Web < 1.15.26 - Admin+ Stored XSSEPSS 0.4%CVE-2023-6629MEDIUMPOST SMTP Mailer <= 2.8.6 - Reflected Cross-Site Scripting via msgEPSS 0.4%CVE-2023-20201MEDIUMMultiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager EPSS 0.4%CVE-2023-27621MEDIUMWordPress Livestream Notice Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%