Weaknesses of type CWE-79

29,952 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-73084MEDIUMActivepieces: Reflected Cross-Site Scripting in OAuth Redirect EndpointEPSS 0.4%CVE-2026-15650MEDIUMRT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block AttributeEPSS 0.4%CVE-2026-15297MEDIUMNewsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) <= 3.1.77 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-90602MEDIUMAnil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scriptingEPSS 0.4%CVE-2024-51801MEDIUMWordPress Brand my Footer plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-22725MEDIUMOrthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the seEPSS 0.4%CVE-2024-50551MEDIUMWordPress EndomondoWP plugin <= 0.1.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-37980MEDIUMOrg.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login pageEPSS 0.4%CVE-2025-11450MEDIUMReflected Cross Site Scripting in ServiceNow AI PlatformEPSS 0.4%CVE-2024-21584MEDIUMPleasanter 1.3.49.0 and earlier contains a cross-site scripting vulnerability. If an attacker tricks the user to access the product with a sEPSS 0.4%CVE-2024-2258MEDIUMForm Maker by 10Web <= 1.15.24 - Authenticated (Subscriber+) Stored Self-Based Cross-Site ScriptingEPSS 0.4%CVE-2024-25898MEDIUMA XSS vulnerability was found in the ChurchCRM v.5.5.0 functionality, edit your event, where malicious JS or HTML code can be inserted in thEPSS 0.4%CVE-2024-50549MEDIUMWordPress Bonway Static Block Editor plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-41241MEDIUMWordPress SureCart Plugin <= 2.5.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-50552MEDIUMWordPress Hover Video Preview plugin <= 1.0.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-6228MEDIUMSina Extension for Elementor <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Sina Posts`, `Sina Blog Post` and `Sina Table` WidgetsEPSS 0.4%CVE-2025-11449MEDIUMReflected Cross Site Scripting in ServiceNow AI PlatformEPSS 0.4%CVE-2024-6340MEDIUMPremium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.4%CVE-2024-4564MEDIUMCoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.4%CVE-2024-5485MEDIUMSureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! <= 1.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trigger Link ShortcodeEPSS 0.4%