Weaknesses of type CWE-79

29,825 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-27993HIGHWordPress Calendarista Basic Edition plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-8241MEDIUMNova Blocks by Pixelgrade <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via align AttributeEPSS 0.4%CVE-2025-22388MEDIUMAn issue was discovered in Optimizely EPiServer.CMS.Core before 12.22.0. A high-severity Stored Cross-Site Scripting (XSS) vulnerability exiEPSS 0.4%CVE-2026-23525MEDIUM1panel App Store vulnerable to Cross-site ScriptingEPSS 0.4%CVE-2023-3369MEDIUMAbout Me 3000 widget <= 2.2.6 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-10034MEDIUMGallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery <= 3.2.4.2 - Authenticated (Editor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-45661MEDIUMA cross-site scripting (XSS) vulnerability in miniTCG v1.3.1 beta allows attackers to execute abritrary web scripts or HTML via injecting a EPSS 0.4%CVE-2024-25696MEDIUMStored XSS in Portal for ArcGISEPSS 0.4%CVE-2025-53904LOWThe Scratch Channel Has Potential Reflected Cross-Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2024-12701MEDIUMWP Smart Import : Import any XML File to WordPress <= 1.1.2 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-20367MEDIUMA vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-siteEPSS 0.4%CVE-2025-53903LOWThe Scratch Channel Has Potential Cross-Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2025-4579HIGHWP Content Security Plugin <= 2.3 - Unauthenticated Stored Cross-Site Scripting via CSP-Report FieldsEPSS 0.4%CVE-2025-56795CRITICALMealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) in the recipe creation functionality. Unsanitized user input in EPSS 0.4%CVE-2023-24747MEDIUMJfinal CMS v5.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/dict/list.EPSS 0.4%CVE-2026-74932HIGHWP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XSS via Host Header Cache PoisoningEPSS 0.4%CVE-2023-6720MEDIUMCross-site Scripting in RepoxEPSS 0.4%CVE-2024-0238MEDIUMEventON (Free < 2.2.8, Premium < 4.5.6) - Unauthenticated Arbitrary Post Metadata UpdateEPSS 0.4%CVE-2024-43417MEDIUMReflected XSS in Software formEPSS 0.4%CVE-2024-29806HIGHWordPress ReDi Restaurant Reservation plugin <= 24.0128 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%