Weaknesses of type CWE-79

29,607 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-2000MEDIUMPremium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multi Scroll WidgetEPSS 0.4%CVE-2024-3308MEDIUMHT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Grid WidgetEPSS 0.4%CVE-2023-4496MEDIUMEasy Chat Server XSS vulnerabilityEPSS 0.4%CVE-2024-2237MEDIUMPremium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Global Badge ModuleEPSS 0.4%CVE-2023-23024MEDIUMBook Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book. This vulnEPSS 0.4%CVE-2022-44960MEDIUMwebtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /general/search.php?searchtype=simple.EPSS 0.4%CVE-2026-59214HIGHOpen WebUI: Stored web worker XSS via PyodideEPSS 0.4%CVE-2025-5975MEDIUMPHPGurukul Rail Pass Management System download-pass.php cross site scriptingEPSS 0.4%CVE-2026-48398MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2023-4492MEDIUMEasy Address Book Web Server XSS vulnerabilityEPSS 0.4%CVE-2024-36577HIGHapphp js-object-resolver < 3.1.1 is vulnerable to Prototype Pollution via Module.setNestedProperty.EPSS 0.4%CVE-2024-2239MEDIUMPremium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Premium Magic Scroll ModuleEPSS 0.4%CVE-2022-40211MEDIUMWordPress GiveWP plugin <= 2.25.1 - Cross Site Scripting (XSS) via render_dropdown vulnerabilityEPSS 0.4%CVE-2024-1458MEDIUMElementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text WidgetEPSS 0.4%CVE-2024-37396MEDIUMA stored cross-site scripting (XSS) vulnerability in the Calendar function of REDCap 13.1.9 allows authenticated users to execute arbitrary EPSS 0.4%CVE-2024-8400MEDIUMStored XSS in gaizhenbiao/chuanhuchatgptEPSS 0.4%CVE-2024-3725MEDIUMOtter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag'EPSS 0.4%CVE-2023-32670CRITICALBuddyBoss XSS vulnerabilityEPSS 0.4%CVE-2024-0954MEDIUMEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-2286MEDIUMSky Addons for Elementor <= 2.4.0 - Authenticated(Contributor+) Stored Cross-site scripting via Wrapper Link URLEPSS 0.4%