Weaknesses of type CWE-79

29,988 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2022-44029MEDIUMAn issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 6 of 6.EPSS 0.4%CVE-2026-73428MEDIUMTrix: Stored XSS via HTMLParser attribute injection on pasteEPSS 0.4%CVE-2023-26290MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSGEPSS 0.4%CVE-2026-102982HIGHPlane: XSS in work item commentsEPSS 0.4%CVE-2025-0972MEDIUMZenvia Movidesk New Ticket cross site scriptingEPSS 0.4%CVE-2023-32797HIGHWordPress video carousel slider with lightbox Plugin <= 1.0.22 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-3929MEDIUMContent Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Post OverlayEPSS 0.4%CVE-2024-34765MEDIUMWordPress Sensei Pro (WC Paid Courses) plugin <= 4.23.1.1.23.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-10348MEDIUMStored Cross-Site Scripting in URVE Smart OfficeEPSS 0.4%CVE-2024-29929MEDIUMWordPress WCFM plugin <= 6.7.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-47698MEDIUMCOMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cross Site Scripting (XSSEPSS 0.4%CVE-2024-11019MEDIUMGrand Vice info Webopac7 - Reflected XSSEPSS 0.4%CVE-2026-111987MEDIUMAUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py read_metadata_from_safetensors cross site scriptingEPSS 0.4%CVE-2023-0746MEDIUMXSS Vulnerability in GigaVue-FMEPSS 0.4%CVE-2024-2287MEDIUMKnight Lab Timeline <= 3.9.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-6910MEDIUMEventON < 2.2.17 - Admin+ Stored XSSEPSS 0.4%CVE-2026-71236HIGHGrocy - Stored XSS via HTMLPurifier Output Double-DecodeEPSS 0.4%CVE-2024-4329MEDIUMThim Elementor Kit <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.4%CVE-2024-3064MEDIUMElementor Addons, Widgets and Enhancements – Stax <= 1.4.4.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-47631HIGHMicrosoft Exchange Server Spoofing VulnerabilityEPSS 0.4%