Weaknesses of type CWE-79

29,873 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-11720HIGHFrontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-11327MEDIUMClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages <= 2.4.1 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2025-9432MEDIUMmtons mblog Admin Panel list cross site scriptingEPSS 0.4%CVE-2023-22857HIGHStored cross-site scripting in BlogEngine.NET version 3.3.8.0EPSS 0.4%CVE-2024-51989HIGHCross-site Scripting (XSS) Vulnerability in PasswordPusherEPSS 0.4%CVE-2024-50541MEDIUMWordPress Advanced Control Manager plugin <= 2.16.0 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-13363MEDIUMRaptive Ads <= 3.6.3 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-6625MEDIUMWP Total Branding <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via title ParameterEPSS 0.4%CVE-2025-7354MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin ShortcodesEPSS 0.4%CVE-2023-25477MEDIUMWordPress Video Gallery Plugin <= 1.3.12 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-40336MEDIUMidccms v1.35 is vulnerable to Cross Site Scripting (XSS) within the 'Image Advertising Management.'EPSS 0.4%CVE-2024-10233MEDIUMSMSAlert - WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe ShortcodeEPSS 0.4%CVE-2025-2195MEDIUMMRCMS org.marker.mushroom.controller.FileController rename.do rename cross site scriptingEPSS 0.4%CVE-2024-2753LOWConcrete CMS version 9 below 9.2.8 and below 8.5.16 is vulnerable to stored XSS on the calendar color settings screenEPSS 0.4%CVE-2024-4892MEDIUMBuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-87812HIGHSiYuan before v3.8.2 Stored XSS via Bazaar iconURLEPSS 0.4%CVE-2025-9431MEDIUMmtons mblog search cross site scriptingEPSS 0.4%CVE-2026-110037MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.4%CVE-2023-38521MEDIUMWordPress Exifography Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2023-41737MEDIUMWordPress Swifty Bar, sticky bar by WPGens Plugin <= 1.2.10 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%