Weaknesses of type CWE-79

29,997 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-5504MEDIUMRife Elementor Extensions & Templates <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline WidgetEPSS 0.3%CVE-2022-28975MEDIUMA stored cross-site scripting (XSS) vulnerability in Infoblox NIOS v8.5.2-409296 allows attackers to execute arbitrary web scripts or HTML vEPSS 0.3%CVE-2024-37625MEDIUMzhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /index.phpEPSS 0.3%CVE-2026-13770MEDIUMAppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX HandlerEPSS 0.3%CVE-2026-113654MEDIUMApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content renderEPSS 0.3%CVE-2026-4653MEDIUMBlock, Suspend, Report for BuddyPress <= 3.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link' ParameterEPSS 0.3%CVE-2024-13393MEDIUMVideo Share VOD – Turnkey Video Site Builder Script <= 2.6.31 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-4868MEDIUMExtensions for Elementor <= 2.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via EE Events and EE Flipbox WidgetEPSS 0.3%CVE-2024-13386MEDIUMquote-posttype-plugin <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-8861MEDIUMProfileGrid – User Profiles, Groups and Communities <= 5.9.3.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-116675HIGHTinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serializationEPSS 0.3%CVE-2024-12598MEDIUMMyBookProgress by Stormhill Media <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via book ParameterEPSS 0.3%CVE-2026-76573MEDIUMPods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode AttributeEPSS 0.3%CVE-2026-44657HIGHMantisBT: Stored XSS in File DownloadEPSS 0.3%CVE-2026-16788MEDIUMLive Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output ShortcodeEPSS 0.3%CVE-2026-16091MEDIUMGamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' ShortcodeEPSS 0.3%CVE-2026-12939MEDIUMNewsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode AttributeEPSS 0.3%CVE-2026-12938MEDIUMNewsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode AttributeEPSS 0.3%CVE-2024-4190HIGHOpenText ArcSight Logger Stored XSSEPSS 0.3%CVE-2023-6624MEDIUMImport and export users and customers <= 1.24.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcodeEPSS 0.3%