Weaknesses of type CWE-79

29,659 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-2402MEDIUMBetter Comments < 1.5.6 - Admin+ Stored XSSEPSS 0.4%CVE-2024-8730MEDIUMExit Notifier <= 1.10.4 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-7300MEDIUMBolt CMS Showcase Creation showcases cross site scriptingEPSS 0.4%CVE-2023-2328MEDIUMCross-site Scripting (XSS) - Generic in pimcore/pimcoreEPSS 0.4%CVE-2023-49178HIGHWordPress HDW Player Plugin (Video Player & Video Gallery) Plugin <= 5.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-36110HIGHCross-site scripting in ansibleguy-webuiEPSS 0.4%CVE-2023-48326HIGHWordPress Events Manager Plugin <= 6.4.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-49771HIGHWordPress Smart External Link Click Monitor [Link Log] Plugin <= 5.0.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-32796HIGHWordPress WooCommerce Product Enquiry Plugin <= 2.3.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-29183MEDIUMOpenRASP vulnerable to a reflected Cross-Site Scripting (XSS) attack in /loginEPSS 0.4%CVE-2024-8731MEDIUMCron Jobs <= 1.2.9 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-25642MEDIUMHedgeDoc security headers for uploaded files were not workingEPSS 0.4%CVE-2023-34088HIGHCollabora Online has Stored Cross-Site-Scripting vulnerability in admin interfaceEPSS 0.4%CVE-2024-33819MEDIUMGlobitel KSA SpeechLog v8.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Save Query function.EPSS 0.4%CVE-2025-22623MEDIUMAd Inserter - Reflected cross-site scripting (XSS)EPSS 0.4%CVE-2026-38472MEDIUMA Stored XSS vulnerability in forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows EPSS 0.4%CVE-2026-51565MEDIUMCross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8 allows remote attackers to inject arbitrarEPSS 0.4%CVE-2023-5073MEDIUMiframe forms <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via iframe ShortcodeEPSS 0.4%CVE-2024-24060MEDIUMspringboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/user.EPSS 0.4%CVE-2023-34375HIGHWordPress Seo By 10Web Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%