Weaknesses of type CWE-79

29,814 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-8664MEDIUMWP Test Email <= 1.1.7 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-55566MEDIUMYamcs: DOM XSS in Extension RoutingEPSS 0.4%CVE-2024-3794MEDIUMCross-site Scripting vulnerability in WBSAirbackEPSS 0.4%CVE-2022-47438MEDIUMWordPress Booking calendar, Appointment Booking System Plugin <= 3.2.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-13334MEDIUMMang Board WP <= 2.3.4 - Reflected Cross-Site Scripting via 'stag' ParameterEPSS 0.4%CVE-2026-75964MEDIUMUser Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' ParameterEPSS 0.4%CVE-2024-3790MEDIUMCross-site Scripting vulnerability in WBSAirbackEPSS 0.4%CVE-2026-87917MEDIUMMC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content TagEPSS 0.4%CVE-2026-89081MEDIUMTutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' ParametersEPSS 0.4%CVE-2026-34557CRITICALCI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.4%CVE-2026-47099LOWTeleJSON < 6.0.0 DOM-based XSS via parse() FunctionEPSS 0.4%CVE-2026-91775HIGHLimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warningsEPSS 0.4%CVE-2024-9205MEDIUMMaximum Products per User for WooCommerce <= 4.2.8 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-44484MEDIUMOnline Blood Donation Management System v1.0 - Stored Cross-Site Scripting (XSS)EPSS 0.4%CVE-2026-17528MEDIUMVersions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element. An attacker can supEPSS 0.4%CVE-2025-2213MEDIUMCastlenet CBW383G2N Wireless Menu wlanPrimaryNetwork.asp cross site scriptingEPSS 0.4%CVE-2026-34558CRITICALCI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.4%CVE-2022-43668MEDIUMTypora versions prior to 1.4.4 fails to properly neutralize JavaScript code, which may result in executing JavaScript code contained in the EPSS 0.4%CVE-2024-3795MEDIUMCross-site Scripting vulnerability in WBSAirbackEPSS 0.4%CVE-2026-41932MEDIUMVvveb < 1.0.8.3 Stored XSS via Signup ControllerEPSS 0.4%