Weaknesses of type CWE-79

29,693 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-0898MEDIUMChat Bubble <= 2.3 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2021-46875MEDIUMAn issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .htEPSS 0.4%CVE-2023-39437HIGHCross-Site Scripting (XSS) vulnerability in SAP Business OneEPSS 0.4%CVE-2024-29125HIGHWordPress Coupon Affiliates plugin <= 5.12.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-31145MEDIUMReflected XSS vulnerability in CollaboraOnlineEPSS 0.4%CVE-2024-43359NONEXSS vulnerabilities in montagereviewEPSS 0.4%CVE-2024-29117HIGHWordPress Contact Forms by Cimatti plugin <= 1.7.0 - Unauthenticated Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-34561MEDIUMA cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload EPSS 0.4%CVE-2025-27679MEDIUMVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross-Site Scripting in Badge RegisEPSS 0.4%CVE-2024-23888HIGHCross-Site Scripting (XSS) vulnerability in Cups EasyEPSS 0.4%CVE-2025-3467HIGHXSS Vulnerability in langgenius/difyEPSS 0.4%CVE-2023-47759MEDIUMWordPress Chaty plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-27962HIGHWordPress wp-mpdf plugin <= 3.7.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-39828MEDIUMR74n Sandboxels 1.9 through 1.9.5 allows XSS via a message in a modified saved-game file. This was fixed in a hotfix to 1.9.5 on 2024-06-29.EPSS 0.4%CVE-2024-1046MEDIUMPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-11591MEDIUMWidgets for Google Reviews <= 13.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fomo-title' and 'fomo-text' ParametersEPSS 0.4%CVE-2023-35878MEDIUMWordPress Extra User Details Plugin <= 0.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-11893MEDIUMSpoki – Chat Buttons and WooCommerce Notifications <= 2.15.15 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2021-21542MEDIUMDell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious EPSS 0.4%CVE-2023-36473MEDIUMCSP nonce reuse vulnerability in DiscourseEPSS 0.4%