Weaknesses of type CWE-79

29,621 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-6789MEDIUMPAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web InterfaceEPSS 0.4%CVE-2022-40290MEDIUMReflected cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.EPSS 0.4%CVE-2024-39162MEDIUMpyspider through 0.3.10 allows /update XSS. NOTE: This vulnerability only affects products that are no longer supported by the maintainerEPSS 0.4%CVE-2025-31081HIGHWordPress Enable Media Replace plugin <= 4.1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-2523LOWMAGESH-K21 Online-College-Event-Hall-Reservation-System booktime.php cross site scriptingEPSS 0.4%CVE-2025-54423MEDIUMcopyparty has a DOM-Based XSS vulnerability when displaying multimedia metadataEPSS 0.4%CVE-2024-2065LOWSourceCodester Barangay Population Monitoring System update-resident.php cross site scriptingEPSS 0.4%CVE-2024-10785MEDIUMGutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-41239MEDIUMDOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM modeEPSS 0.4%CVE-2024-11829MEDIUMThe Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.1.8 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-13202MEDIUMwander-chu SpringBoot-Blog Blog Article PageController.java modifiyArticle cross site scriptingEPSS 0.4%CVE-2023-25040MEDIUMWordPress Shortcodes Ultimate Plugin <= 5.12.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-8152CRITICALUnblu Spark Open Redirect leading to DOM-Based XSSEPSS 0.4%CVE-2023-29636MEDIUMCross site scripting (XSS) vulnerability in ZHENFENG13 My-Blog, allows attackers to inject arbitrary web script or HTML via the "title" fielEPSS 0.4%CVE-2018-25097LOWAcumos Design Studio cross site scriptingEPSS 0.4%CVE-2024-10197MEDIUMcode-projects Pharmacy Management System Manage Supplier Page manage_supplier.php cross site scriptingEPSS 0.4%CVE-2020-19660MEDIUMCross Site Scripting (XSS) pandao editor.md 1.5.0 allows attackers to execute arbitrary code via crafted linked url values.EPSS 0.4%CVE-2023-50947MEDIUMIBM Business Automation Workflow cross-site scriptingEPSS 0.4%CVE-2024-11116MEDIUMInappropriate implementation in Blink in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who convinced a user to engage in spEPSS 0.4%CVE-2023-30489HIGHWordPress Email Subscription Popup Plugin <= 1.2.16 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%