Weaknesses of type CWE-79

29,607 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-8366MEDIUMPortabilis i-Educar educar_servidor_lst.php cross site scriptingEPSS 0.4%CVE-2019-25421MEDIUMComodo Dome Firewall 2.7.0 Cross-Site Scripting via policyfwEPSS 0.4%CVE-2024-8149MEDIUMBUG-000168624 - Unvalidated redirect in Portal for ArcGIS.EPSS 0.4%CVE-2023-4495MEDIUMEasy Chat Server XSS vulnerabilityEPSS 0.4%CVE-2024-30179MEDIUMWordPress Bold Page Builder plugin <= 4.7.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-2138MEDIUMJetWidgets For Elementor <= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Box WidgetEPSS 0.4%CVE-2024-2185MEDIUMBeaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box WidgetEPSS 0.4%CVE-2024-34090HIGHAn issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. The login banner inEPSS 0.4%CVE-2024-23729MEDIUMThe ColorOS Internet Browser com.heytap.browser application 45.10.3.4.1 for Android allows a remote attacker to execute arbitrary JavaScriptEPSS 0.4%CVE-2026-73700CRITICALAuthenticated Stored Cross-Site Scripting Vulnerability (XSS) in HPE Networking Fabric Composer Web-Based Management InterfaceEPSS 0.4%CVE-2024-3985MEDIUMExclusive Addons for Elementor <= 2.6.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call to ActionEPSS 0.4%CVE-2023-6986MEDIUMEmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2025-12289MEDIUMSui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1001 cross site scriptingEPSS 0.4%CVE-2024-2238MEDIUMPremium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Mouse Cursor ModuleEPSS 0.4%CVE-2024-13119MEDIUMProfilePress < 4.15.20 - Admin+ Stored XSSEPSS 0.4%CVE-2023-29508HIGHorg.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site ScriptingEPSS 0.4%CVE-2026-18147HIGHFreeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted urlEPSS 0.4%CVE-2024-10865CRITICALReflected Cross-Site Scripting vulnerability in OpenText Advanced AuthenticationEPSS 0.4%CVE-2024-1680MEDIUMPremium Addons for Elementor <= 4.10.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Banner, Team Members, and Image Scroll WidgetsEPSS 0.4%CVE-2022-44955MEDIUMwebtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the Chat function. This vulnerability allows attackeEPSS 0.4%