Weaknesses of type CWE-79

29,988 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-5686MEDIUMWPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members WidgetEPSS 0.4%CVE-2023-50826MEDIUMWordPress Menu Image, Icons made easy Plugin <= 3.10 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-43439MEDIUMMoodle: reflected xss via h5p error messageEPSS 0.4%CVE-2024-3634MEDIUMmonth name translation benaceur < 2.3.8 - Admin+ Stored XSSEPSS 0.4%CVE-2024-37619HIGHStrongShop v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the spec_group_id parameter at /spec/indeEPSS 0.4%CVE-2025-5420MEDIUMjuzaweb CMS Profile Page upload cross site scriptingEPSS 0.4%CVE-2026-12592HIGHSlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry HeaderEPSS 0.4%CVE-2022-33961MEDIUMWordPress YellowPencil Visual CSS Style Editor Plugin <= 7.5.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-1931HIGHRent Fetch <= 0.32.4 - Unauthenticated Stored Cross-Site Scripting via 'keyword' ParameterEPSS 0.4%CVE-2026-112184MEDIUMMISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form LabelsEPSS 0.4%CVE-2025-22619MEDIUMWeGIA Cross-Site Scripting (XSS) Reflected endpoint 'editar_permissoes.php' parameter 'msg_c'EPSS 0.4%CVE-2023-50357MEDIUMCross site scripting vulnerability in AREAL SAS Webserv1 ASP Web SiteEPSS 0.4%CVE-2024-41959HIGHCross-site Scripting (XSS) via API Logs in mailcow: dockerizedEPSS 0.4%CVE-2023-1840MEDIUMSp*tify Play Button for WordPress <= 2.07 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-13155MEDIUMUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.140 - Authenticated (Contributor+) Stored Cross-Site Scripting via Transparent Split Hero WidgetEPSS 0.4%CVE-2025-6452MEDIUMCodeAstro Patient Record Management System Generate New Report Page cross site scriptingEPSS 0.4%CVE-2021-47779HIGHDolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting (XSS) / Privilege EscalationEPSS 0.4%CVE-2024-20305MEDIUMA vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a cEPSS 0.4%CVE-2024-37031MEDIUMThe Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create eEPSS 0.4%CVE-2026-30864HIGHCombodo iTop: Reflected XSS in dashboard revertEPSS 0.4%