Weaknesses of type CWE-79

29,611 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-13771MEDIUMCustomer Reviews for WooCommerce <= 5.113.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode AttributeEPSS 0.4%CVE-2025-65572MEDIUMCross Site Scripting (XSS) vulnerability in AllskyTeam AllSky v2024.12.06_06 allows remote attackers to execute arbitrary code via the (1) cEPSS 0.4%CVE-2026-13295MEDIUMPage Builder by SiteOrigin <= 2.34.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via panels_data ParameterEPSS 0.4%CVE-2025-3598MEDIUMCoupon Affiliates – Affiliate Plugin for WooCommerce <= 6.3.0 - Reflected Cross-Site Scripting via 'commission_summary' ParameterEPSS 0.4%CVE-2026-8599MEDIUMMailerPress <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Campaign HTML Content FieldEPSS 0.4%CVE-2024-10928MEDIUMMonoCMS Posts Page opensaved.php cross site scriptingEPSS 0.4%CVE-2024-24507MEDIUMCross Site Scripting vulnerability in Act-On 2023 allows a remote attacker to execute arbitrary code via the newUser parameter in the login.EPSS 0.4%CVE-2024-8142MEDIUMSourceCodester Daily Calories Monitoring Tool delete-calorie.php cross site scriptingEPSS 0.4%CVE-2023-47658MEDIUMWordPress Extra Product Options for WooCommerce Plugin <= 3.0.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-44212CRITICALPrestaShop: Stored XSS executable in customer service viewEPSS 0.4%CVE-2024-6058MEDIUMLabVantage LIMS cross site scriptingEPSS 0.4%CVE-2026-95682MEDIUMMISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email ViewEPSS 0.4%CVE-2023-45764MEDIUMWordPress Scroll post excerpt Plugin <= 8.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-39610MEDIUMCross-site scripting vulnerability exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an arbitrary script maEPSS 0.4%CVE-2022-45540MEDIUMEyouCMS <= 1.6.0 was discovered a reflected-XSS in article type editor component in POST value "name" if the value contains a malformed UTF-EPSS 0.4%CVE-2023-41661MEDIUMWordPress Smarty for WordPress Plugin <= 3.1.35 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-45537MEDIUMEyouCMS <= 1.6.0 was discovered a reflected-XSS in the article publish component in cookie "ENV_LIST_URL".EPSS 0.4%CVE-2026-42321HIGHGLPI has stored XSS in asset locksEPSS 0.4%CVE-2025-8071MEDIUMMine CloudVod <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via audio ParameterEPSS 0.4%CVE-2024-35432MEDIUMZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting (XSS) via an Audio File. An authenticated user can injection malicious JEPSS 0.4%