Weaknesses of type CWE-79

29,825 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-21046MEDIUMVulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle E-Business Suite (component: LOV). Supported versioEPSS 0.4%CVE-2023-0258LOWSourceCodester Online Food Ordering System Category List cross site scriptingEPSS 0.4%CVE-2026-0586MEDIUMcode-projects Online Product Reservation System prod.php cross site scriptingEPSS 0.4%CVE-2024-25708MEDIUMPersistent XSS when creating new application using Web App BuilderEPSS 0.4%CVE-2024-34240MEDIUMQDOCS Smart School 7.0.0 is vulnerable to Cross Site Scripting (XSS) resulting in arbitrary code execution in admin functions related to addEPSS 0.4%CVE-2026-6817MEDIUMQuiz Maker by AYS <= 6.7.1.29 - Unauthenticated Stored Cross-Site Scripting via 'rate_reason'EPSS 0.4%CVE-2024-12047MEDIUMWP Compress – Instant Performance & Speed Optimization <= 6.30.03 - Reflected Cross-Site Scripting via custom_server ParameterEPSS 0.4%CVE-2026-84219HIGHKirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity DecodingEPSS 0.4%CVE-2025-26065HIGHA cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts oEPSS 0.4%CVE-2023-46925MEDIUMReportico 7.1.21 is vulnerable to Cross Site Scripting (XSS).EPSS 0.4%CVE-2024-36993MEDIUMPersistent Cross-site Scripting (XSS) in Web BulletinEPSS 0.4%CVE-2026-8884MEDIUMInstant-Quote.co Quotation Page <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.4%CVE-2024-25700MEDIUMPersistent XSS in URL added to a shared mapEPSS 0.4%CVE-2025-53903LOWThe Scratch Channel Has Potential Cross-Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2024-0238MEDIUMEventON (Free < 2.2.8, Premium < 4.5.6) - Unauthenticated Arbitrary Post Metadata UpdateEPSS 0.4%CVE-2024-11203MEDIUMEmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name'EPSS 0.4%CVE-2024-20367MEDIUMA vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-siteEPSS 0.4%CVE-2026-16573HIGHBit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature UploadEPSS 0.4%CVE-2024-5955MEDIUMCross-site scripting vulnerability in Trellix ePolicy Orchestrator prior to ePO 5.10 Service Pack 1 Update 3 allows a remote authenticated aEPSS 0.4%CVE-2024-8241MEDIUMNova Blocks by Pixelgrade <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via align AttributeEPSS 0.4%