Weaknesses of type CWE-79

29,607 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-1411MEDIUMPowerPack Addons for Elementor <= 2.7.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Buttons WidgetEPSS 0.4%CVE-2024-1424MEDIUMGiveWP – Donation Plugin and Fundraising Platform <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-3891MEDIUMHappy Addons for Elementor <= 3.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML TagsEPSS 0.4%CVE-2023-4497MEDIUMEasy Chat Server XSS vulnerabilityEPSS 0.4%CVE-2022-44962MEDIUMwebtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /calendar/viewcalendar.php. This vulneEPSS 0.4%CVE-2024-3885MEDIUMPremium Addons for Elementor <= 4.10.28 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-2186MEDIUMBeaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members WidgetEPSS 0.4%CVE-2025-12290MEDIUMSui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 359 cross site scriptingEPSS 0.4%CVE-2026-33979HIGHExpress XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)EPSS 0.4%CVE-2024-1414MEDIUMExclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action WidgetEPSS 0.4%CVE-2024-11240MEDIUMIBPhoenix ibWebAdmin Banco de Dados Tab database.php cross site scriptingEPSS 0.4%CVE-2024-2187MEDIUMBeaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials WidgetEPSS 0.4%CVE-2023-6806MEDIUMStarbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Job SettingsEPSS 0.4%CVE-2024-30435HIGHWordPress Nexter Blocks plugin <= 3.2.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-29113HIGHWordPress RegistrationMagic plugin <= 5.2.5.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2018-11449—A vulnerability has been identified in SCALANCE M875 (All versions). An attacker with access to the local file system might obtain passwordsEPSS 0.4%CVE-2024-0310MEDIUM A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the reEPSS 0.4%CVE-2024-41513MEDIUMA reflected cross-site scripting (XSS) vulnerability in "Artikel.aspx" in CADClick v1.11.0 and before allows remote attackers to inject arbiEPSS 0.4%CVE-2024-33571HIGHWordPress VOD Infomaniak plugin <= 1.5.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-62172HIGHHome Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity NameEPSS 0.4%