Weaknesses of type CWE-79

29,849 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2021-39014MEDIUMIBM Cloud Object Storage System cross-site scriptingEPSS 0.4%CVE-2025-22855LOWAn improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Fortinet FortiClient beforEPSS 0.4%CVE-2025-2699MEDIUMGetmeUK ContentTools Image cross site scriptingEPSS 0.4%CVE-2026-85022MEDIUMlanggenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scriptingEPSS 0.4%CVE-2025-52468HIGHChamilo: Stored XSS Vulnerability via CSV User ImportEPSS 0.4%CVE-2023-27777MEDIUMCross-site scripting (XSS) vulnerability was discovered in Online Jewelry Shop v1.0 that allows attackers to execute arbitrary script via a EPSS 0.4%CVE-2024-41725HIGHDover Fueling Solutions ProGauge MAGLINK LX CONSOLE Cross-site ScriptingEPSS 0.4%CVE-2023-2558MEDIUMWPCS – WordPress Currency Switcher Professional <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2025-6778MEDIUMcode-projects Food Distributor Site save_settings.php cross site scriptingEPSS 0.4%CVE-2026-104073MEDIUMNetBox 2.9.5 < 4.7.0 Session Hijacking via Custom LinksEPSS 0.4%CVE-2024-3023MEDIUMAnnounceKit <= 2.0.9 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-41860MEDIUMWordPress Travel Map Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-40641MEDIUMStored Cross-Site Scripting (XSS) in the Multi-purpose Inventory Management SystemEPSS 0.4%CVE-2024-3030MEDIUMAnnounce from the Dashboard <= 1.5.2 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-33840MEDIUMIBM Security Verify Governance cross-site scriptingEPSS 0.4%CVE-2025-1332MEDIUMFastCMS Template Menu menu cross site scriptingEPSS 0.4%CVE-2024-4983MEDIUMThe Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.0- Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-52274MEDIUMmember/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header.EPSS 0.4%CVE-2022-22402MEDIUMIBM Aspera Faspex cross-site scriptingEPSS 0.4%CVE-2023-23900MEDIUMWordPress Easy Forms for Mailchimp Plugin <= 6.8.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%