Weaknesses of type CWE-79

29,637 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-47847MEDIUMVarious XSSes found in CargoEPSS 0.4%CVE-2026-47423HIGHDOMPurify XSS via `selectedcontent` re-cloneEPSS 0.4%CVE-2024-8783MEDIUMOpenTibiaBR MyAAC Post Reply new_post.php cross site scriptingEPSS 0.4%CVE-2026-61824HIGHDefuddle: XSS via unescaped attribute interpolation in site extractorsEPSS 0.4%CVE-2023-27494MEDIUMStreamlit Cross-site Scripting vulnerabilityEPSS 0.4%CVE-2023-49577MEDIUMCross-Site Scripting (XSS) vulnerability in the SAP HCM (SMART PAYE solution)EPSS 0.4%CVE-2024-8141MEDIUMSourceCodester Daily Calories Monitoring Tool add-calorie.php cross site scriptingEPSS 0.4%CVE-2023-25598MEDIUMA vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2 and 20.x, 21.x, and 22.x through 22.24.1500.0 could EPSS 0.4%CVE-2026-18331HIGHFormidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' ParameterEPSS 0.4%CVE-2024-5369MEDIUMKashipara College Management System submit_admin.php cross site scriptingEPSS 0.4%CVE-2023-46613MEDIUMWordPress Add to Calendar Button Plugin < 1.5.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-8137MEDIUMSourceCodester Record Management System search_user.php cross site scriptingEPSS 0.4%CVE-2025-49579MEDIUMCitizen allows stored XSS in menu heading messageEPSS 0.4%CVE-2024-54316MEDIUMWordPress Restaurant & Cafe Addon for Elementor plugin <= 1.5.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-49160MEDIUMWordPress Formzu WP Plugin <= 1.6.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-46069MEDIUMWordPress Ajax Archive Calendar Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-1226LOWCross-site Scripting (XSS) in phpipam/phpipamEPSS 0.4%CVE-2026-0617HIGHLatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-3251MEDIUMxujiangfei admintwo updateSet cross site scriptingEPSS 0.4%CVE-2023-46935MEDIUMeyoucms v1.6.4 is vulnerable Cross Site Scripting (XSS), which can lead to stealing sensitive information of logged-in users.EPSS 0.4%