Weaknesses of type CWE-79

29,621 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-47968MEDIUMHeimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. The storeEPSS 0.4%CVE-2024-12024HIGHEventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type NameEPSS 0.4%CVE-2023-35882MEDIUMWordPress Super Socializer Plugin <= 7.13.52 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-47812MEDIUMWordPress Bamboo Columns Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-12536MEDIUMSourceCodester Kortex Lite Advocate Office Management System client_data.php cross site scriptingEPSS 0.4%CVE-2025-0583MEDIUMaEnrich Technology a+HRD - Reflected Cross-site Scripting(XSS)EPSS 0.4%CVE-2025-22636HIGHWordPress VR-Frases plugin <= 4.0.1 - Reflected XSS to SQL Injection vulnerabilityEPSS 0.4%CVE-2025-51053MEDIUMA Cross-site scripting (XSS) vulnerability in /api_vedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary JavascripEPSS 0.4%CVE-2025-46959MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%CVE-2022-41433MEDIUMEyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /module/adEPSS 0.4%CVE-2024-9682MEDIUMRoyal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Form Builder WidgetEPSS 0.4%CVE-2024-5266MEDIUMDownload Manager <= 3.2.92 - Authenticated (Author+) Stored Cross-Site Scripting via Multiple ShortcodesEPSS 0.4%CVE-2023-47811MEDIUMWordPress Anywhere Flash Embed Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-47810MEDIUMWordPress Ajax Domain Checker Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-93956MEDIUMolivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scriptingEPSS 0.4%CVE-2023-47808MEDIUMWordPress Add Widgets to Page Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-12522MEDIUMYay! Forms | Embed Custom Forms, Surveys, and Quizzes Easily <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-8740MEDIUMGetResponse Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-63459HIGHVendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptionsEPSS 0.4%CVE-2025-46877MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.4%