Weaknesses of type CWE-79

29,761 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2019-1677MEDIUMCisco Webex Meetings for Android Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2023-24383MEDIUMWordPress Namaste! LMS Plugin <= 2.5.9.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-5425HIGHWidgets for Social Photo Feed <= 1.7.9 - Unauthenticated Stored Cross-Site Scripting via feed_dataEPSS 0.4%CVE-2025-4223MEDIUMPage Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url ParameterEPSS 0.4%CVE-2022-44582MEDIUMWordPress Apptivo Business Site CRM Plugin <= 3.0.12 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-44735MEDIUMWordPress WP Clictracker Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-24396MEDIUMWordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.5.11 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-44266MEDIUMWordPress WP Adminify Plugin <= 3.1.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-37523MEDIUMHCL BigFix OSD Bare Metal Server WebUI is affected by missing or insecure tagsEPSS 0.4%CVE-2024-27729HIGHCross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the location parameteEPSS 0.4%CVE-2026-26989MEDIUMLibreNMS has Stored XSS in Alert RuleEPSS 0.4%CVE-2023-23995MEDIUMWordPress TinyMCE Custom Styles Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-93885HIGHCryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object ParameterEPSS 0.4%CVE-2023-23971MEDIUMWordPress WP Time Slots Booking Form Plugin <= 1.1.81 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-47158MEDIUMWordPress alfred24 Click & Collect Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-2834HIGHAge Verification & Identity Verification by Token of Trust <= 3.32.3 - Unauthenticated Stored Cross-Site Scripting via 'description' ParameterEPSS 0.4%CVE-2023-22679MEDIUMWordPress WP Better Emails Plugin <= 0.4 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-32206MEDIUMA stored cross-site scripting (XSS) vulnerability in the component \affiche\admin\index.php of WUZHICMS v4.1.0 allows attackers to execute aEPSS 0.4%CVE-2026-40284MEDIUMWeGIA has stored XSS in listar_despachos.phpEPSS 0.4%CVE-2023-20041MEDIUMMultiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthentiEPSS 0.4%