Weaknesses of type CWE-79

29,818 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-5218MEDIUMReviews and Rating – Google Reviews <= 5.2 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-29469MEDIUMA stored cross-site scripting (XSS) vulnerability in OneBlog v2.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted EPSS 0.4%CVE-2024-29124MEDIUMWordPress Advanced Access Manager plugin <= 6.9.20 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-15730MEDIUMGamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode AttributeEPSS 0.4%CVE-2023-23756—Extension - advcomsys.com - XSS in oneVote component for Joomla <= 1.7.0EPSS 0.4%CVE-2025-29156MEDIUMCross Site Scripting vulnerability in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via a crafted script to the /api/vEPSS 0.4%CVE-2026-33080HIGHFilament: Unvalidated Range and Values summarizer values can be used for XSSEPSS 0.4%CVE-2024-1366MEDIUMHappy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Archive Title WidgetEPSS 0.4%CVE-2026-5410MEDIUMRedux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field InputEPSS 0.4%CVE-2025-60991HIGHA reflected cross-site scripted (XSS) vulnerability in Codazon Magento Themes v1.1.0.0 to v2.4.7 allows attackers to execute arbitrary JavasEPSS 0.4%CVE-2020-36919MEDIUMWPForms 1.7.8 - Cross-Site Scripting (XSS)EPSS 0.4%CVE-2024-27998HIGHWordPress Barcode Scanner and Inventory manager plugin <= 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-22856HIGHStored cross-site scripting in BlogEngine.NET version 3.3.8.0EPSS 0.4%CVE-2025-1817MEDIUMMini-Tmall Admin Name admin cross site scriptingEPSS 0.4%CVE-2024-25597HIGHWordPress Ultimate Reviews plugin <= 3.2.8 - Unauthenticated Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-45717HIGHSolarWinds Platform Cross- Site Scripting VulnerabilityEPSS 0.4%CVE-2024-1239MEDIUMElementsKit Elementor addons <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-8724MEDIUMWaitlist Woocommerce ( Back in stock notifier ) <= 2.7.5 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-30449HIGHWordPress Booking Activities plugin <= 1.15.19 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-22352MEDIUMIBM Sterling B2B Integrator Standard Edition cross-site scriptingEPSS 0.4%