Weaknesses of type CWE-79

29,816 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-6092MEDIUMcomfyanonymous comfyui Incomplete Fix CVE-2024-10099 image cross site scriptingEPSS 0.4%CVE-2025-3795MEDIUMDaiCuo SEO Optimization Settings Section cross site scriptingEPSS 0.4%CVE-2022-22999HIGHCross-site Scripting Vulnerability in USB Backups AppEPSS 0.4%CVE-2025-1592MEDIUMSourceCodester Best Employee Management System Add Role Page Role.php cross site scriptingEPSS 0.4%CVE-2026-33135CRITICALWeGIA has Reflected Cross-Site Scripting (XSS) in `novo_memorandoo.php` via `sccs` parameterEPSS 0.4%CVE-2024-46980MEDIUMTuleap vulnerable to XSS in the HTML mail content of the cross reference fieldEPSS 0.4%CVE-2024-13591MEDIUMTeam Builder For WPBakery Page Builder(Formerly Visual Composer) <= 1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-38466MEDIUMA Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864EPSS 0.4%CVE-2022-45087MEDIUMCross-site Scripting in Smartpower WebEPSS 0.4%CVE-2025-2371MEDIUMPHPGurukul Human Metapneumovirus Testing Management System Registered Mobile Number Search registered-user-testing.php cross site scriptingEPSS 0.4%CVE-2024-12290MEDIUMInfility Global <= 2.9.8 - Reflected Cross-Site Scripting via set_type ParameterEPSS 0.4%CVE-2023-5114MEDIUMidbbee <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-11369MEDIUMStore credit / Gift cards for woocommerce <= 1.0.49.46 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-27921MEDIUMA reflected cross-site scripting (XSS) vulnerability was discovered in Output Messenger before 2.0.63, where unsanitized input could be injeEPSS 0.4%CVE-2025-59332HIGH3DAlloy allows stored XSS through attributes provided to the 3d parser tag/functionEPSS 0.4%CVE-2025-0710MEDIUMCampCodes School Management Software Notice Board Page notice-list cross site scriptingEPSS 0.4%CVE-2025-34281MEDIUMStored Cross-Site Scripting (XSS) in ThingsBoardEPSS 0.4%CVE-2025-11687MEDIUMGi-docgen: reflected dom xss in gi-docgenEPSS 0.4%CVE-2026-36214MEDIUMosTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip cEPSS 0.4%CVE-2024-11746MEDIUMDiscover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%