Weaknesses of type CWE-79

29,842 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-42909MEDIUMWEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codeEPSS 0.4%CVE-2024-51822MEDIUMWordPress Creative Blocks plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-3028MEDIUMerzhongxmu JEEWMS JeecgListDemoController.java doAdd cross site scriptingEPSS 0.4%CVE-2025-0537MEDIUMcode-projects Car Rental Management System manage-pages.php cross site scriptingEPSS 0.4%CVE-2026-48026HIGHlakeFS vulnerable to stored XSS in rendered markdown previews via raw HTMLEPSS 0.4%CVE-2024-51807MEDIUMWordPress AgendaPress plugin <= 1.0.8 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-21745MEDIUMWordPress Laybuy Payment Extension for WooCommerce Plugin <= 5.3.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-110847HIGHn8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss ParameterEPSS 0.4%CVE-2026-89256CRITICALAVideo Bookmark Plugin Stored XSS via Chapter NamesEPSS 0.4%CVE-2025-5135MEDIUMTmall Demo Product Details Page admin cross site scriptingEPSS 0.4%CVE-2026-87813HIGHSiYuan before v3.8.2 Stored XSS via unescaped asset filenamesEPSS 0.4%CVE-2025-6268MEDIUMLuna Imaging search cross site scriptingEPSS 0.4%CVE-2024-43369HIGHPersistent Cross-site Scripting in Ibexa RichText Field TypeEPSS 0.4%CVE-2025-5153MEDIUMCMS Made Simple Design Manager Module cross site scriptingEPSS 0.4%CVE-2024-51802MEDIUMWordPress Bread & Butter plugin <= 7.4.857 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-33998MEDIUMmoodle: stored XSS via user's name on participants page when opening some optionsEPSS 0.4%CVE-2024-5994MEDIUMWP Go Maps (formerly WP Google Maps) <= 9.0.38 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-0464MEDIUMSourceCodester Task Reminder System Maintenance Section cross site scriptingEPSS 0.4%CVE-2025-22525MEDIUMWordPress Donation Block For PayPal Plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-15170MEDIUMAdvaya Softech GEMS ERP Portal Error Message home.jsp cross site scriptingEPSS 0.4%