Weaknesses of type CWE-79

29,607 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-41613MEDIUMA Cross Site Scripting (XSS) vulnerability in Symphony CMS 2.7.10 allows remote attackers to inject arbitrary web script or HTML by editing EPSS 0.4%CVE-2024-4302MEDIUMSuper 8 livechat SDK - Cross-site ScriptingEPSS 0.4%CVE-2024-38521HIGHPersistent Cross-Site Scripting (XSS) in hushline inboxEPSS 0.4%CVE-2024-8119MEDIUMThe Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via pageEPSS 0.4%CVE-2025-49576MEDIUMCitizen allows stored XSS in search no result messagesEPSS 0.4%CVE-2024-8802MEDIUMClio Grow <= 1.0.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-15440HIGHiONE360 configurator <= 2.0.57 - Unauthenticated Stored Cross-Site Scripting via Contact Form ParametersEPSS 0.4%CVE-2020-22540MEDIUMStored Cross-Site Scripting (XSS) vulnerability in Codoforum v4.9, allows attackers to execute arbitrary code and obtain sensitive informatiEPSS 0.4%CVE-2024-25698MEDIUMReflected XSS in Portal for ArcGISEPSS 0.4%CVE-2024-3752MEDIUMCrelly Slider <= 1.4.5 - Admin+ Stored XSSEPSS 0.4%CVE-2025-49577MEDIUMCitizen allows stored XSS in preference menu headingsEPSS 0.4%CVE-2024-9349MEDIUMAuto Amazon Links – Amazon Associates Affiliate Plugin <= 5.4.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-21730MEDIUM[20240702] - Core - Self-XSS in fancyselect list field layoutEPSS 0.4%CVE-2025-12976MEDIUMEvents Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' ShortcodeEPSS 0.4%CVE-2023-26100MEDIUMIn Progress Flowmon before 12.2.0, an application endpoint failed to sanitize user-supplied input. A threat actor could leverage a reflectedEPSS 0.4%CVE-2024-27525MEDIUMCross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the fileEPSS 0.4%CVE-2019-25420MEDIUMComodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via snatEPSS 0.4%CVE-2024-22418MEDIUMStored Cross-site Scripting Vulnerability via Malicious File Names in GroupOfficeEPSS 0.4%CVE-2019-25423MEDIUMComodo Dome Firewall 2.7.0 Cross-Site Scripting via proxyconfigEPSS 0.4%CVE-2024-6256MEDIUMFeeds for YouTube (YouTube video, channel, and gallery plugin) <= 2.2.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.4%