Weaknesses of type CWE-79

29,596 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-2349MEDIUMFancy Elementor Flipbox <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Elementor Flipbox WidgetEPSS 0.4%CVE-2023-6525MEDIUMElementsKit Elementor addons <= 3.0.3 - Authenticated(Editor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-31803HIGHCombodo iTop: Reflected XSS in tag adminEPSS 0.4%CVE-2020-36769HIGHWidget Settings Importer/Exporter Plugin <= 1.5.3 - Unauthorized Widget Import to Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-30826HIGHCombodo iTop: Reflected XSS in run_query.phpEPSS 0.4%CVE-2026-93778HIGHWP Yelp Review Slider <= 9.2 - Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source)EPSS 0.4%CVE-2026-13360HIGHCookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' ParameterEPSS 0.4%CVE-2022-43697MEDIUMOX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob.EPSS 0.4%CVE-2026-5324HIGHBrizy – Page Builder <= 2.8.11 - Unauthenticated Stored Cross-Site Scripting via FileUpload Field ValueEPSS 0.4%CVE-2026-74800CRITICALSiYuan before v3.7.4 Stored XSS via assets endpointEPSS 0.4%CVE-2025-62366LOWMailgen vulnerable to HTML injection and cross-site scripting via plaintext email generationEPSS 0.4%CVE-2024-1447MEDIUMSydney Toolbox <= 1.25 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-31880HIGHCombodo iTop: Reflected XSS in universal searchEPSS 0.4%CVE-2023-47696HIGHWordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-0788MEDIUMALGO 8180 IP Audio Alerter Web UI Persistent Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2024-42918MEDIUMitsourcecode Online Accreditation Management System contains a Cross Site Scripting vulnerability, which allows an attacker to execute arbitEPSS 0.4%CVE-2024-10433MEDIUMProject Worlds Simple Web-Based Chat Application index.php cross site scriptingEPSS 0.4%CVE-2025-3894MEDIUMStored XSS in MegaBIPEPSS 0.4%CVE-2024-6005MEDIUMZKTeco ZKBio CVSecurity V5000 Department Section cross site scriptingEPSS 0.4%CVE-2026-15298HIGHTelSender <= 1.14.14 - Unauthenticated Stored Cross-Site Scripting via Telegram Chat TitleEPSS 0.4%