Weaknesses of type CWE-79

29,593 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-41434MEDIUMEyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /lilac/maiEPSS 0.4%CVE-2024-24905HIGHDell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability. An adjacent network EPSS 0.4%CVE-2026-16260MEDIUMPost Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title FieldEPSS 0.4%CVE-2026-83547MEDIUMXpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple WidgetsEPSS 0.4%CVE-2026-86784MEDIUMVisualizer < 4.0.8 - Contributor+ Stored XSS via JSON Data SourceEPSS 0.4%CVE-2026-14290MEDIUMEmbed Google Photos Album Easily <= 2.2.1 - Contributor+ Stored XSS via link Shortcode AttributeEPSS 0.4%CVE-2026-82884MEDIUMAll in One SEO < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant BlockEPSS 0.4%CVE-2026-19615MEDIUMAdmin and Site Enhancements < 9.0.1 - Author+ Stored XSS via SVG Upload over XML-RPCEPSS 0.4%CVE-2026-86780MEDIUMFeatured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt TextEPSS 0.4%CVE-2026-84021MEDIUMBold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URLEPSS 0.4%CVE-2024-29833MEDIUMWordPress Photo Gallery Plugin <= 1.8.21 Stored Cross Site Scripting in UploadHandlerEPSS 0.4%CVE-2026-84088MEDIUMXpro Elementor Addons < 1.7.9 - Contributor+ Stored XSS via Interactive Circle WidgetEPSS 0.4%CVE-2026-86790MEDIUMWP Highlight Box <= 1.0 - Contributor+ Stored XSS via highlight-box ShortcodeEPSS 0.4%CVE-2026-15047MEDIUMs2Member < 260805 - Contributor+ Stored XSS via ShortcodeEPSS 0.4%CVE-2026-14817MEDIUMElement Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data AttributesEPSS 0.4%CVE-2026-82846MEDIUMMasteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom FieldsEPSS 0.4%CVE-2023-5910LOWPopojiCMS Web Config install.php cross site scriptingEPSS 0.4%CVE-2024-4649LOWCampcodes Complete Web-Based School Management System student_exam_mark_insert_form1.php cross site scriptingEPSS 0.4%CVE-2026-16069MEDIUMBrizy - Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal PointEPSS 0.4%CVE-2024-51857MEDIUMWordPress Olympus Shortcodes plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%