Weaknesses of type CWE-79

29,677 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-8563MEDIUMSourceCodester PHP CRUD update.php cross site scriptingEPSS 0.4%CVE-2024-26101MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.4%CVE-2024-5375MEDIUMKashipara College Management System submit_student.php cross site scriptingEPSS 0.4%CVE-2024-50659MEDIUMCross Site Scripting vulnerability iPublish Media Solutions AdPortal 3.0.39 allows a remote attacker to escalate privileges via the shippingEPSS 0.4%CVE-2023-47239MEDIUMWordPress Easy PayPal Shopping Cart Plugin <= 1.1.10 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-5894LOWCross-site Scripting (XSS) - Stored in pkp/ojsEPSS 0.4%CVE-2024-4479MEDIUMJeg Elementor Kit <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Tabs and JKit - Accordion WidgetsEPSS 0.4%CVE-2025-22131MEDIUMCross-Site Scripting (XSS) vulnerability in generateNavigation() functionEPSS 0.4%CVE-2024-40730MEDIUMA cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload EPSS 0.4%CVE-2024-32334MEDIUMTOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in IP/Port Filtering under the Firewall PageEPSS 0.4%CVE-2025-55071MEDIUMA reflected cross-site scripting (xss) vulnerability exists in the modifyAnonymize functionality of MedDream PACS Premium 7.3.6.870. A speciEPSS 0.4%CVE-2024-54272MEDIUMWordPress Radius Blocks plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-48765MEDIUMWordPress Email Address Encoder Plugin <= 1.0.22 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-36453MEDIUMCross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820. If thiEPSS 0.4%CVE-2024-40732HIGHA cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload EPSS 0.4%CVE-2025-54852MEDIUMA reflected cross-site scripting (xss) vulnerability exists in the modifyAeTitle functionality of MedDream PACS Premium 7.3.6.870. A specialEPSS 0.4%CVE-2024-40734MEDIUMA cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload EPSS 0.4%CVE-2024-10745MEDIUMPHPGurukul Online Shopping Portal deferred_table.php cross site scriptingEPSS 0.4%CVE-2024-51814MEDIUMWordPress 活动链接推广插件 plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-7122MEDIUMElementor Addon Elements <= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.4%