Weaknesses of type CWE-79

29,626 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-8991MEDIUMOSM <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via osm_map and osm_map_v3 ShortcodesEPSS 0.4%CVE-2023-5895LOWCross-site Scripting (XSS) - DOM in pkp/pkp-libEPSS 0.4%CVE-2023-41236HIGHWordPress Happy Elementor Addons Pro Plugin <= 2.8.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-60503HIGHA cross-site scripting (XSS) vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 where input submitted iEPSS 0.4%CVE-2024-54403HIGHWordPress Visual Recent Posts plugin <= 1.2.3 - Reflected Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.4%CVE-2023-35884HIGHWordPress EventPrime Plugin <= 3.0.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-9923MEDIUMCampcodes Sales and Inventory System index.php cross site scriptingEPSS 0.4%CVE-2024-50532HIGHWordPress Events Manager Pro – extended plugin <= 0.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-56314MEDIUMA stored cross-site scripting (XSS) vulnerability in the Project name of REDCap through 14.9.6 allows authenticated users to inject maliciouEPSS 0.4%CVE-2025-4987HIGHStored Cross-site Scripting (XSS) vulnerability affecting Opportunity Management in Project Portfolio Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025xEPSS 0.4%CVE-2024-47528MEDIUMLibreNMS Contains a Stored XSS via File UploadEPSS 0.4%CVE-2024-30880MEDIUMReflected Cross Site Scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML aEPSS 0.4%CVE-2019-17003MEDIUMScanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed.EPSS 0.4%CVE-2024-51093HIGHStored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScripEPSS 0.4%CVE-2023-27629MEDIUMWordPress Site Reviews Plugin <= 6.5.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-51497MEDIUMLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.phpEPSS 0.4%CVE-2024-28091MEDIUMTechnicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct storEPSS 0.4%CVE-2024-54390HIGHWordPress TagGator plugin <= 1.54 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-34401MEDIUMSavsoft Quiz 6.0 allows stored XSS via the index.php/quiz/insert_quiz/ quiz_name parameter.EPSS 0.4%CVE-2024-22639MEDIUMiGalerie v3.0.22 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Titre (Title) field in the editing iEPSS 0.4%