Weaknesses of type CWE-79

29,596 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-8985MEDIUMSocial Proof (Testimonials) Slider <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via spslider-block ShortcodeEPSS 0.4%CVE-2024-1449MEDIUMMaster Slider – Responsive Touch Slider <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-11376MEDIUMs2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241216 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-9616MEDIUMBlockMeister – Block Pattern Builder <= 3.1.10 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-8934MEDIUM1000 Projects Sales Management System sales.php cross site scriptingEPSS 0.4%CVE-2024-26467MEDIUMA DOM based cross-site scripting (XSS) vulnerability in the component generator.html of tabatkins/railroad-diagrams before commit ea9a123 alEPSS 0.4%CVE-2025-3669MEDIUMSupreme Addons for Beaver Builder <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_qrcodesabb ShortcodeEPSS 0.4%CVE-2023-25018MEDIUMRifartek IOT Wall - Reflected XSSEPSS 0.4%CVE-2023-25154HIGHCross site scripting (XSS) of ActivityPub URI in misskeyEPSS 0.4%CVE-2024-4209MEDIUMGutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown TimerEPSS 0.4%CVE-2023-22902MEDIUMOpenfind Mail2000 - XSSEPSS 0.4%CVE-2024-3680MEDIUMEnter Addons – Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animation Title widget img tagEPSS 0.4%CVE-2025-49898HIGHWordPress Dropshix plugin <= 4.0.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-8968MEDIUMMaxButtons < 9.8.1 - Admin+ Stored XSS via Text ColorEPSS 0.4%CVE-2024-27626MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Dotclear version 2.29. The flaw exists within the Search functioEPSS 0.4%CVE-2025-7959MEDIUMStation Pro <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width and height ParametersEPSS 0.4%CVE-2025-8933MEDIUM1000 Projects Sales Management System sales.php cross site scriptingEPSS 0.4%CVE-2024-4487MEDIUMBlocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG UploadsEPSS 0.4%CVE-2025-46837HIGHAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2024-3161MEDIUMJeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.4%