Weaknesses of type CWE-79

29,825 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-47685HIGHFOGProject has stored XSS via unauthenticated inventory service renders unescaped in Host Management pageEPSS 0.4%CVE-2024-13351HIGHSocial proof testimonials and reviews by Repuso <= 5.20 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-8236MEDIUMElementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-30200HIGHWordPress BEAR plugin <= 1.1.4.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-7818MEDIUMPHPGurukul Apartment Visitors Management System HTTP POST Request category.php cross site scriptingEPSS 0.4%CVE-2025-7817MEDIUMPHPGurukul Apartment Visitors Management System HTTP POST Request bwdates-reports.php cross site scriptingEPSS 0.4%CVE-2023-5096MEDIUMHTML filter and csv-file search <= 2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-29805HIGHWordPress Shipping with Venipak for WooCommerce plugin <= 1.19.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-23198MEDIUMStored-XSS-LibreNMS-Display-Name in librenmsEPSS 0.4%CVE-2024-54687MEDIUMVtiger CRM v.6.1 and before is vulnerable to Cross Site Scripting (XSS) via the Documents module and function uploadAndSaveFile in CRMEntityEPSS 0.4%CVE-2024-12239MEDIUMPowerPack Lite for Beaver Builder <= 1.3.0.5 - Reflected Cross-Site Scripting via Navigate ParameterEPSS 0.4%CVE-2024-57488MEDIUMCode-Projects Online Car Rental System 1.0 is vulnerable to Cross Site Scripting (XSS) via the vehicalorcview parameter in /admin/edit-vehicEPSS 0.4%CVE-2024-31256HIGHWordPress WebinarPress plugin <= 1.33.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-1159MEDIUMCampCodes School Management Software academic-calendar cross site scriptingEPSS 0.4%CVE-2026-88057MEDIUMAngular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compilerEPSS 0.4%CVE-2023-5120MEDIUMMigration, Backup, Staging – WPvivid <= 0.9.89 - Authenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2022-23791MEDIUMXSS in Firmanet Software and Technology Customer Relation ManagerEPSS 0.4%CVE-2024-1586MEDIUMSchema & Structured Data for WP & AMP <= 1.26 - Authenticated (Custom) Stored Cross-Site ScriptingEPSS 0.4%CVE-2022-2178MEDIUMXSS in Saysis' StarcitiesEPSS 0.4%CVE-2025-12484HIGHGiveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers <= 1.12.19 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%