Weaknesses of type CWE-79

29,984 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-4411MEDIUMMihdan: Yandex Turbo Feed <= 1.6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-2347MEDIUMAstra <= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display NameEPSS 0.4%CVE-2023-26291MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSGEPSS 0.4%CVE-2023-41658HIGHWordPress Photo Gallery Slideshow & Masonry Tiled Gallery Plugin <= 1.0.13 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-11418MEDIUMAdditional Order Filters for WooCommerce <= 1.21 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-9116MEDIUMMonkee-Boy Essentials <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.4%CVE-2025-6347MEDIUMcode-projects Responsive Blog pageViewMembers.php cross site scriptingEPSS 0.4%CVE-2024-40727MEDIUMA cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload EPSS 0.4%CVE-2024-38711HIGHWordPress Link Library plugin <= 7.7.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-57556MEDIUMCross Site Scripting vulnerability in nbubna store v.2.14.2 and before allows a remote attacker to execute arbitrary code via the store.deepEPSS 0.4%CVE-2023-5562MEDIUMUnsafe default allows for cross-site scripting attacks in KNIME Server and KNIME Business HubEPSS 0.4%CVE-2023-29791MEDIUMkodbox <= 1.37 is vulnerable to Cross Site Scripting (XSS) via the debug information.EPSS 0.4%CVE-2024-40738HIGHA cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload EPSS 0.4%CVE-2022-44025MEDIUMAn issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 2 of 6.EPSS 0.4%CVE-2022-4771MEDIUMHitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') EPSS 0.4%CVE-2026-73428MEDIUMTrix: Stored XSS via HTMLParser attribute injection on pasteEPSS 0.4%CVE-2024-4193MEDIUMTestimonial Slider <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-2009HIGHNewsletters <= 4.9.9.7 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-38045—Extension - admiror-design-studio.com - XSS in Admiror Gallery component for Joomla 5.0.0-5.2.0EPSS 0.4%CVE-2024-46470MEDIUMCross Site Scripting vulnerability in CodeAstro Membership Management System 1.0 allows attackers to run malicious JavaScript via the memberEPSS 0.4%