Weaknesses of type CWE-79

29,818 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-22357MEDIUMIBM Sterling B2B Integrator cross-site scriptingEPSS 0.4%CVE-2023-1209MEDIUMCross-Site Scripting (XSS) vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arbitrary scripts.EPSS 0.4%CVE-2025-30533MEDIUMWordPress Message ticker plugin <= 9.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2025-26929MEDIUMWordPress Accounting for WooCommerce plugin <= 1.6.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-30536MEDIUMWordPress Beautiful Link Preview plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-8661MEDIUMServer-Side Cross-Site Scripting and SSRF in Rapid7 InsightConnect Markdown to PDF PluginEPSS 0.4%CVE-2023-51064MEDIUMQStar Archive Solutions Release RELEASE_3-0 Build 7 Patch 0 was discovered to contain a DOM Based reflected XSS vulnerability within the comEPSS 0.4%CVE-2025-2261HIGHTIBCO BPM Enterprise XSS VulnerabilityEPSS 0.4%CVE-2024-11855MEDIUMKoalendar – Events & Appointments Booking Calendar <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via height ParameterEPSS 0.4%CVE-2024-5879MEDIUMHubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics <= 11.1.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via HubSpot Meeting WidgetEPSS 0.4%CVE-2025-24579MEDIUMWordPress Nested pages plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-40739MEDIUMA cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload EPSS 0.4%CVE-2026-68528MEDIUMConcrete CMS 9.5.2 and below is vulnerable to Stored XSS in RSS Displayer Block via Unescaped Remote Feed Item titleEPSS 0.4%CVE-2025-30532MEDIUMWordPress Weather Layer plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-42248MEDIUMQlikView 12.60.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the QvsViewClient functionality.EPSS 0.4%CVE-2024-5530MEDIUMShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Product Horizontal Filter WidgetEPSS 0.4%CVE-2025-30847MEDIUMWordPress Novelist plugin <= 1.2.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2024-29116HIGHWordPress WooThumbs for WooCommerce by Iconic plugin <= 5.5.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-6699MEDIUMLabRedesCefetRJ WeGIA Cadastro de Funcionário cadastro_funcionario.php cross site scriptingEPSS 0.4%CVE-2024-33548HIGHWordPress WZone plugin <= 14.0.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%