Weaknesses of type CWE-79

29,607 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-63135HIGHYOURLS: Stored XSS in referrer statistics chart via crafted Referer headerEPSS 0.4%CVE-2020-18280MEDIUMCross Site Scripting vulnerability found in Phodal CMD v.1.0 allows a local attacker to execute arbitrary code via the EMBED SRC function.EPSS 0.4%CVE-2024-5479HIGHEasy Pixels by JEVNET <= 2.13 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-11115HIGHInsufficient policy enforcement in Navigation in Google Chrome on iOS prior to 131.0.6778.69 allowed a remote attacker to perform privilege EPSS 0.4%CVE-2024-8556MEDIUMStored XSS in modelscope/agentscopeEPSS 0.4%CVE-2024-2926MEDIUMElementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Various WidgetsEPSS 0.4%CVE-2025-4512MEDIUMInetum IODAS app.jsp cross site scriptingEPSS 0.4%CVE-2026-18372MEDIUMCSS injection in M-Files WebEPSS 0.4%CVE-2024-4212MEDIUMThemesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple WidgetsEPSS 0.4%CVE-2025-0301MEDIUMcode-projects Online Book Shop subcat.php cross site scriptingEPSS 0.4%CVE-2022-45437MEDIUMStored cross-site scripting vulnerability in the reporting dashboard moduleEPSS 0.4%CVE-2026-10712HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.4%CVE-2023-48313MEDIUMUmbraco contains a DOM-XSSEPSS 0.4%CVE-2024-8117MEDIUMThe Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via selected_optionEPSS 0.4%CVE-2024-9667MEDIUMSeriously Simple Podcasting <= 3.5.0 - Reflected Cross-Site Scripting via add_query_arg ParameterEPSS 0.4%CVE-2024-26465MEDIUMA DOM based cross-site scripting (XSS) vulnerability in the component /beep/Beep.Instrument.js of stewdio beep.js before commit ef22ad7 alloEPSS 0.4%CVE-2026-25733HIGHRucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule FunctionEPSS 0.4%CVE-2025-49575MEDIUMCitizen allows stored XSS in Command Palette tip messagesEPSS 0.4%CVE-2023-6142MEDIUMDev Blog v1.0 - Stored XSSEPSS 0.4%CVE-2024-42901MEDIUMA CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file.EPSS 0.4%