Weaknesses of type CWE-79

29,654 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-3776MEDIUMNetvision airPASS - Reflected XSSEPSS 0.4%CVE-2025-12246MEDIUMchatwoot Admin IframeLoader.vue cross site scriptingEPSS 0.4%CVE-2026-2149MEDIUMSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System appointments.php cross site scriptingEPSS 0.4%CVE-2024-36417MEDIUMSuiteCRM Stored XSS Vulnerability Allows Code Execution via Malicious iFrameEPSS 0.4%CVE-2025-1579MEDIUMcode-projects Blood Bank System user.php cross site scriptingEPSS 0.4%CVE-2023-25466MEDIUMWordPress Who Hit The Page – Hit Counter Plugin <= 1.4.14.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-29964MEDIUMHSC MailInspector v5.3.3-7 contains a Cross-Site Scripting (XSS) vulnerability in the /tap/tap.php endpoint due to improper neutralization oEPSS 0.4%CVE-2024-31649MEDIUMA cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML viaEPSS 0.4%CVE-2026-2150MEDIUMSourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System checkin.php cross site scriptingEPSS 0.4%CVE-2025-34512MEDIUMIlevia EVE X1 Server 4.7.18.0.eden Reflected XSSEPSS 0.4%CVE-2024-51494MEDIUMLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.phpEPSS 0.4%CVE-2024-51495MEDIUMLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.phpEPSS 0.4%CVE-2024-7082MEDIUMeasy-table-of-contents < 2.0.68 - Editor+ Stored XSSEPSS 0.4%CVE-2025-15093MEDIUMsunkaifei FlyCMS Admin Login IndexAdminController.java cross site scriptingEPSS 0.4%CVE-2024-56376MEDIUMA stored cross-site scripting (XSS) vulnerability in the built-in messenger of REDCap 14.9.6 allows authenticated users to inject malicious EPSS 0.4%CVE-2024-11895MEDIUMOnline Payments – Get Paid with PayPal, Square & Stripe <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2022-47607MEDIUMWordPress Usersnap Plugin <= 4.16 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-47687HIGHFOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpointEPSS 0.4%CVE-2023-6911MEDIUMMultiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can beEPSS 0.4%CVE-2024-1242MEDIUMPremium Addons for Elementor <= 4.10.18 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%