Weaknesses of type CWE-79

29,953 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-9885MEDIUMWidget or Sidebar Shortcode <= 0.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-37161MEDIUMMeterSphere front-end editor stores XSS vulnerabilityEPSS 0.4%CVE-2026-1134MEDIUMitsourcecode Society Management System expenses.php cross site scriptingEPSS 0.4%CVE-2024-20270MEDIUMA vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended ServiceEPSS 0.4%CVE-2025-5179MEDIUMRealce Tecnologia Queue Ticket Kiosk Cadastro de Administrador Page index.php cross site scriptingEPSS 0.4%CVE-2026-42849CRITICALauthentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeoverEPSS 0.4%CVE-2025-63589HIGHA reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker-controlled path segments are not sanitized or encodEPSS 0.4%CVE-2024-50520MEDIUMWordPress Ancient World Linked Data plugin <= 0.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-6200HIGHHaloITSM - Stored Cross-Site Scripting in TicketsEPSS 0.4%CVE-2024-1377MEDIUMHappy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Meta WidgetEPSS 0.4%CVE-2024-51799MEDIUMWordPress Bg Patriarchia BU plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-9886MEDIUMWP Baidu Map <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2023-25365HIGHCross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3EPSS 0.4%CVE-2025-65442MEDIUMDOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code orEPSS 0.4%CVE-2024-51801MEDIUMWordPress Brand my Footer plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-2337MEDIUMEasy Testimonials <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-10367MEDIUMOtter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2024-1028LOWSourceCodester Facebook News Feed Like Post cross site scriptingEPSS 0.4%CVE-2024-31928MEDIUMWordPress Top Bar plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-52283MEDIUMMissing sanitation of inputs allowed arbitrary users to conduct a stored XSS attack that triggers for users that view a certain projectEPSS 0.4%