Weaknesses of type CWE-79

29,592 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-13394MEDIUMViewMedica 9 <= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-1647MEDIUMXSS in Bootstrap title attribute for Tooltip and PopoverEPSS 0.4%CVE-2024-12258MEDIUMWP Service Payment Form With Authorize.net <= 2.6.3 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-62701MEDIUMStored XSS through system messagesEPSS 0.4%CVE-2021-36806MEDIUM A reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to an error page on Sophos Email Appliance EPSS 0.4%CVE-2024-11361MEDIUMPDF Invoices & Packing Slips Generator for WooCommerce <= 2.2.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2022-4958LOWqkmc-rk redbbs Post cross site scriptingEPSS 0.4%CVE-2023-25200MEDIUMAn HTML injection vulnerability exists in the MT Safeline X-Ray X3310 webserver version NXG 19.05 that enables a remote attacker to render mEPSS 0.4%CVE-2019-15706MEDIUMAn improper neutralization of input during web page generation in the SSL VPN portal of FortiProxy version 2.0.0, version 1.2.9 and below anEPSS 0.4%CVE-2026-83541MEDIUMSina Extension for Elementor 3.7.1 - 3.10.3 - Contributor+ Stored XSS via Table WidgetEPSS 0.4%CVE-2026-83545MEDIUMCoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSONEPSS 0.4%CVE-2026-84022MEDIUMBold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element AttributesEPSS 0.4%CVE-2023-1248MEDIUM Possible XSS in Ticket ActionsEPSS 0.4%CVE-2022-41434MEDIUMEyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /lilac/maiEPSS 0.4%CVE-2024-53470MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in the component /configuracao/gateway_pagamento.php of WeGIA v3.2.0 allows attacEPSS 0.4%CVE-2026-84930MEDIUMCatFolders Document Gallery < 2.0.7 - Author+ Stored XSS via titleTag Block AttributeEPSS 0.4%CVE-2026-76558MEDIUMWP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS via Custom Field NamesEPSS 0.4%CVE-2026-13605MEDIUMPhoto Swipe <= 4.1.1.1 - Author+ Stored XSS via title AttributeEPSS 0.4%CVE-2026-82884MEDIUMAll in One SEO < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant BlockEPSS 0.4%CVE-2026-14290MEDIUMEmbed Google Photos Album Easily <= 2.2.1 - Contributor+ Stored XSS via link Shortcode AttributeEPSS 0.4%