Weaknesses of type CWE-79

29,988 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-53471MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in the component /configuracao/meio_pagamento.php of WeGIA v3.2.0 allows attackerEPSS 0.4%CVE-2026-0540MEDIUMDOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XMLEPSS 0.4%CVE-2022-44028MEDIUMAn issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 5 of 6.EPSS 0.4%CVE-2024-3064MEDIUMElementor Addons, Widgets and Enhancements – Stax <= 1.4.4.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-29929MEDIUMWordPress WCFM plugin <= 6.7.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-0972MEDIUMZenvia Movidesk New Ticket cross site scriptingEPSS 0.4%CVE-2023-4090MEDIUMCross-Site Scripting (XSS) vulnerability on WideStand CMS of AciliaEPSS 0.4%CVE-2023-0746MEDIUMXSS Vulnerability in GigaVue-FMEPSS 0.4%CVE-2024-3241MEDIUMUltimate Blocks < 3.1.7 - Contributor+ Stored XSSEPSS 0.4%CVE-2024-40731MEDIUMA cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload EPSS 0.4%CVE-2026-71236HIGHGrocy - Stored XSS via HTMLPurifier Output Double-DecodeEPSS 0.4%CVE-2024-12474MEDIUMGeoDataSource Country Region DropDown <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-2287MEDIUMKnight Lab Timeline <= 3.9.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-34765MEDIUMWordPress Sensei Pro (WC Paid Courses) plugin <= 4.23.1.1.23.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2022-45441MEDIUMA cross-site scripting (XSS) vulnerability in Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.13)C0, which could allow an attacker tEPSS 0.4%CVE-2024-5686MEDIUMWPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members WidgetEPSS 0.4%CVE-2026-48060HIGHLitestar: HTML Injection Through CSRF TokenEPSS 0.4%CVE-2024-30438MEDIUMWordPress Print Page block plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-3634MEDIUMmonth name translation benaceur < 2.3.8 - Admin+ Stored XSSEPSS 0.4%CVE-2025-10534HIGHSpoofing issue in the Site Permissions componentEPSS 0.4%