Weaknesses of type CWE-79

29,693 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-39971—Extension - acymailing.com - XSS in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3EPSS 0.4%CVE-2023-5357MEDIUMInstagram for WordPress <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-34582MEDIUMSunhillo SureLine through 8.10.0 on RICI 5000 devices allows cgi/usrPasswd.cgi userid_change XSS within the Forgot Password feature.EPSS 0.4%CVE-2023-34961MEDIUMChamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the /feedback/comment field.EPSS 0.4%CVE-2023-1197MEDIUMCross-site Scripting (XSS) - Stored in uvdesk/community-skeletonEPSS 0.4%CVE-2024-9502MEDIUMMaster Addons -- Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip ModuleEPSS 0.4%CVE-2026-39344HIGHReflected XSS the login page through the 'username' parameterEPSS 0.4%CVE-2026-112249MEDIUMgrandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scriptingEPSS 0.4%CVE-2025-2087MEDIUMStarSea99 starsea-mall update cross site scriptingEPSS 0.4%CVE-2024-30199HIGHWordPress WP-Lister Lite for Amazon plugin <= 2.6.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-29094HIGHWordPress HT Easy GA4 plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-40741HIGHA cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload EPSS 0.4%CVE-2024-23884HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.4%CVE-2026-52725MEDIUMAngular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)EPSS 0.4%CVE-2024-34906MEDIUMAn arbitrary file upload vulnerability in dootask v0.30.13 allows attackers to execute arbitrary code via uploading a crafted PDF file.EPSS 0.4%CVE-2025-4325MEDIUMMRCMS Category Management Page add.do cross site scriptingEPSS 0.4%CVE-2024-25093HIGHWordPress GD Rating System Plugin <= 3.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-24027MEDIUMIn MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name.EPSS 0.4%CVE-2025-1170MEDIUMcode-projects Real Estate Property Management System Category.php cross site scriptingEPSS 0.4%CVE-2026-33673HIGHPrestaShop has multiple stored XSS vulnerabilities via unprotected Template variablesEPSS 0.4%