Weaknesses of type CWE-79

29,628 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-41735MEDIUMIBM Business Process Manager cross-site scriptingEPSS 0.4%CVE-2024-50522HIGHWordPress WeChat Subscribers Lite plugin <= 1.6.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-30880MEDIUMReflected Cross Site Scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML aEPSS 0.4%CVE-2024-4615MEDIUMElespare – Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import: No Coding Required! <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Horizontal Nav Menu WidgetEPSS 0.4%CVE-2024-54390HIGHWordPress TagGator plugin <= 1.54 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-4987HIGHStored Cross-site Scripting (XSS) vulnerability affecting Opportunity Management in Project Portfolio Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025xEPSS 0.4%CVE-2023-35884HIGHWordPress EventPrime Plugin <= 3.0.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-2598HIGHCross-Site Scripting (XSS) in AMSS++EPSS 0.4%CVE-2024-28091MEDIUMTechnicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct storEPSS 0.4%CVE-2025-9923MEDIUMCampcodes Sales and Inventory System index.php cross site scriptingEPSS 0.4%CVE-2019-17003MEDIUMScanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed.EPSS 0.4%CVE-2024-56314MEDIUMA stored cross-site scripting (XSS) vulnerability in the Project name of REDCap through 14.9.6 allows authenticated users to inject maliciouEPSS 0.4%CVE-2024-2594HIGHCross-Site Scripting (XSS) in AMSS++EPSS 0.4%CVE-2025-24027MEDIUMps_contactinfo has potential XSS due to usage of the nofilter tag in templateEPSS 0.4%CVE-2023-5233MEDIUMFont Awesome Integration <= 5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-45206MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. Through the help document endpoint in webmail, an attacker can EPSS 0.4%CVE-2024-45153MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-5125MEDIUMContact Form by FormGet <= 5.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2022-45363MEDIUMWordPress Betheme premium theme <= 26.6.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-45065HIGHWordPress SEO Plugin by Squirrly SEO Plugin <= 12.1.20 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%