Weaknesses of type CWE-79

29,867 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-38489MEDIUMAn issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03 It is prone to stored Cross-site Scripting (XSS). Version 2022.1.110.1EPSS 0.4%CVE-2025-54967MEDIUMAn issue was discovered in BAE SOCET GXP before 4.6.0.3. It permits external entities in certain XML-based files. An attacker who is able toEPSS 0.4%CVE-2024-4866MEDIUMUltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.4%CVE-2024-9376MEDIUMKata Plus – Addons for Elementor – Widgets, Extensions and Templates <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2025-7500MEDIUMOcean Social Sharing <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-1687LOWSourceCodester Simple Task Allocation System cross site scriptingEPSS 0.4%CVE-2025-8786MEDIUMPortabilis i-Diario Registro das atividades registros-de-conteudos-por-areas-de-conhecimento cross site scriptingEPSS 0.4%CVE-2025-5378MEDIUMAstun Technology iShare Maps mycouncil2.aspx cross site scriptingEPSS 0.4%CVE-2024-8959MEDIUMWP Adminify – Best WordPress Custom Dashboard Plugin <= 4.0.1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2023-1689LOWSourceCodester Earnings and Expense Tracker App cross site scriptingEPSS 0.4%CVE-2025-5134MEDIUMTmall Demo Buy Item Page cross site scriptingEPSS 0.4%CVE-2024-13401MEDIUMPayment Button for PayPal <= 1.2.3.35 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-46338MEDIUMAudiobookshelf Vulnerable to Cross-Site-Scripting Reflected via POST Request in /api/uploadEPSS 0.4%CVE-2023-29637MEDIUMCross Site Scripting (XSS) vulnerability in Qbian61 forum-java, allows attackers to inject arbitrary web script or HTML via editing the artiEPSS 0.4%CVE-2026-88209MEDIUMMicrosoft Office SharePoint Spoofing VulnerabilityEPSS 0.4%CVE-2024-9967MEDIUMWP show more <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via show_more ShortcodeEPSS 0.4%CVE-2023-3757LOWGZ Scripts Car Rental Script cross site scriptingEPSS 0.4%CVE-2023-46066MEDIUMWordPress Mediabay Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-12517MEDIUMWooCommerce Cart Count Shortcode <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-27093MEDIUMCross Site Scripting vulnerability found in My-Blog allows attackers to cause a denial of service via the Post function.EPSS 0.4%