Weaknesses of type CWE-79

29,693 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-40668MEDIUMWordPress Save as PDF plugin by Pdfcrowd Plugin <= 2.16.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-44173MEDIUMOnline Movie Ticket Booking System v1.0 - Reflected Cross-Site Scripting (XSS)EPSS 0.4%CVE-2023-43971MEDIUMCross Site Scripting vulnerability in ACG-faka v1.1.7 allows a remote attacker to execute arbitrary code via the encode parameter in Index.pEPSS 0.4%CVE-2024-30201HIGHWordPress WP Smart Import plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-59417MEDIUMLobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat MessagesEPSS 0.4%CVE-2022-26328LOWUser enumeration vulnerability has been discovered in OpenText™ Performance CenterEPSS 0.4%CVE-2026-12399MEDIUMGutenverse <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts[].font.font.value' ParameterEPSS 0.4%CVE-2026-11898MEDIUMWhite Label CMS <= 2.7.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import SettingsEPSS 0.4%CVE-2023-33311MEDIUMWordPress Contact Form Entries Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-40665MEDIUMWordPress Save as Image plugin by Pdfcrowd Plugin <= 2.16.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-25874MEDIUMA cross-site scripting (XSS) vulnerability in the New/Edit Article module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scEPSS 0.4%CVE-2026-56670HIGHComfyUI: Stored XSS via SVG file upload on the /view endpointEPSS 0.4%CVE-2024-0821MEDIUMCost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce <= 3.2.8 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-11356MEDIUMIvory Search <= 5.5.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' SettingsEPSS 0.4%CVE-2023-23816MEDIUMWordPress Sitemap Index Plugin <= 1.2.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-41242MEDIUMWordPress Snap Pixel Plugin <= 1.5.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-25551MEDIUM A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on a DCE fileEPSS 0.4%CVE-2026-41683HIGHHTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language headerEPSS 0.4%CVE-2019-25425MEDIUMComodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via smtpconfigEPSS 0.4%CVE-2024-24115MEDIUMA stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti CMS v0.9.24 allows authenticated attackers to executeEPSS 0.4%