Weaknesses of type CWE-79

29,818 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-9346MEDIUMEmbed videos and respect privacy <= 1.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-5218MEDIUMReviews and Rating – Google Reviews <= 5.2 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-9610MEDIUMLanguage Switcher <= 3.7.13 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-1585MEDIUMotale header.html OptionsService cross site scriptingEPSS 0.4%CVE-2024-7691MEDIUMFlaming Forms <= 1.0.1 - Unauthenticated Stored XSSEPSS 0.4%CVE-2024-29469MEDIUMA stored cross-site scripting (XSS) vulnerability in OneBlog v2.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted EPSS 0.4%CVE-2025-29156MEDIUMCross Site Scripting vulnerability in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via a crafted script to the /api/vEPSS 0.4%CVE-2020-36919MEDIUMWPForms 1.7.8 - Cross-Site Scripting (XSS)EPSS 0.4%CVE-2024-25597HIGHWordPress Ultimate Reviews plugin <= 3.2.8 - Unauthenticated Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-27998HIGHWordPress Barcode Scanner and Inventory manager plugin <= 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-24881HIGHWordPress WP SMS Plugin <= 6.5.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-23756—Extension - advcomsys.com - XSS in oneVote component for Joomla <= 1.7.0EPSS 0.4%CVE-2024-21154MEDIUMVulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Human Resources). The supported veEPSS 0.4%CVE-2025-31510HIGHIn the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (intEPSS 0.4%CVE-2024-9232MEDIUMDownload Plugins and Themes in ZIP from Dashboard <= 1.9.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-28002HIGHWordPress Cornerstone plugin <= 0.8.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-30447HIGHWordPress Creative Image Slider plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-9344MEDIUMBerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript <= 2.1.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-13669MEDIUMCalendApp <= 1.1 - Reflected XSSEPSS 0.4%CVE-2024-29470MEDIUMOneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component {{rootpath}}/links.EPSS 0.4%