Weaknesses of type CWE-79

29,816 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-53278MEDIUMCross-site scripting vulnerability exists in WP Admin UI Customize versions prior to ver 1.5.14. If a malicious admin user customizes the adEPSS 0.4%CVE-2023-43988MEDIUMAn issue in nature fitness saijo mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channeEPSS 0.4%CVE-2024-27706MEDIUMCross Site Scripting vulnerability in Huly Platform v.0.6.202 allows attackers to execute arbitrary code via upload of crafted SVG file to iEPSS 0.4%CVE-2023-23467HIGHMedia CP Media Control Panel – Reflected XSSEPSS 0.4%CVE-2023-46094HIGHWordPress Conversios.io Plugin <= 6.5.3 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-47626HIGHiTop vulnerable to XSS vulnerability in authent-tokenEPSS 0.4%CVE-2024-22549MEDIUMFlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the email settings of the website settings section.EPSS 0.4%CVE-2024-12845MEDIUMEmlog Pro common.php cross site scriptingEPSS 0.4%CVE-2024-10510MEDIUMadBuddy+ (AdBlocker Detection) by NetfunkDesign <= 1.1.3 - Admin+ Stored XSSEPSS 0.4%CVE-2023-27059HIGHA cross-site scripting (XSS) vulnerability in the Edit Group function of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts EPSS 0.4%CVE-2025-0248HIGHHCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability,EPSS 0.4%CVE-2023-29441HIGHWordPress WebLibrarian Plugin <= 3.5.8.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-41868HIGHWordPress Stagtools Plugin <= 2.3.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-45254HIGHVaeMendis - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.4%CVE-2024-5878MEDIUMMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript LibraryEPSS 0.4%CVE-2026-56667HIGHZITADEL: Stored XSS via Default URI Redirect in Login V2EPSS 0.4%CVE-2025-3795MEDIUMDaiCuo SEO Optimization Settings Section cross site scriptingEPSS 0.4%CVE-2022-22999HIGHCross-site Scripting Vulnerability in USB Backups AppEPSS 0.4%CVE-2024-13732MEDIUMResponsive Blocks – WordPress Gutenberg Blocks <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via section_tag ParameterEPSS 0.4%CVE-2023-40333HIGHWordPress Bridge Core Plugin <= 3.0.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%