Weaknesses of type CWE-79

29,708 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-9177MEDIUMThemedy Toolbox <= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple ShortcodesEPSS 0.4%CVE-2023-30792MEDIUMAnchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where EPSS 0.4%CVE-2024-9237MEDIUMFish and Ships <= 1.5.9 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-46640MEDIUMWordPress Medialist Plugin <= 1.3.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-33988MEDIUMCross-Site Scripting vulnerability in SAP Enable NowEPSS 0.4%CVE-2025-34404MEDIUMMailEnable < 10.54 Reflected XSS in InstanceScope Parameter of CAL/compose.aspxEPSS 0.4%CVE-2024-8787MEDIUMSmart Online Order for Clover <= 1.5.7 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-5618MEDIUMModern Footnotes <= 1.4.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-12715MEDIUMAsgard Security Scanner <= 0.7 - Reflected XSSEPSS 0.4%CVE-2023-7029MEDIUMWordPress Button Plugin MaxButtons <= 9.7.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcodeEPSS 0.4%CVE-2024-38672HIGHWordPress AdPush plugin <= 1.50 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-54386MEDIUMmarimo < 0.23.9 XSS via file Query Parameter in assets.pyEPSS 0.4%CVE-2025-2340MEDIUMotale Tale Blog Site Settings save saveOptions cross site scriptingEPSS 0.4%CVE-2023-24026MEDIUMIn MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload.EPSS 0.4%CVE-2025-10066MEDIUMitsourcecode POS Point of Sale System dymanic_table.php cross site scriptingEPSS 0.4%CVE-2025-10606MEDIUMPortabilis i-Educar ConfiguracaoMovimentoGeral cross site scriptingEPSS 0.4%CVE-2024-22720MEDIUMKanboard 1.2.34 is vulnerable to Html Injection in the group management feature.EPSS 0.4%CVE-2024-38669HIGHWordPress Predictive Search for WooCommerce plugin <= 6.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-9213MEDIUMPersian WooCommerce SMS <= 7.0.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2022-25774MEDIUMXSS in Notifications via saving DashboardsEPSS 0.4%