Weaknesses of type CWE-79

30,049 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-7232HIGHFormCraft <= 3.9.14 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Sub-ParametersEPSS 0.3%CVE-2025-57117MEDIUMA Clickjacking vulnerability exists in Rems' Employee Management System 1.0. This flaw allows remote attackers to execute arbitrary JavaScriEPSS 0.3%CVE-2021-47914MEDIUMPHP Melody 3.0 Persistent XSS Vulnerability via Edit Video ParameterEPSS 0.3%CVE-2024-6374MEDIUMlahirudanushka School Management System Subject Page subject.php cross site scriptingEPSS 0.3%CVE-2023-31407MEDIUMCross-Site Scripting (XSS) vulnerability in SAP Business Planning and ConsolidationEPSS 0.3%CVE-2024-5024MEDIUMMemberPress <= 1.11.29 - Reflected Cross-Site Scripting via mepr_screenname and mepr_key ParametersEPSS 0.3%CVE-2023-50874MEDIUMWordPress Ajax Load More Plugin <= 6.1.0.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2023-41343MEDIUMRagic No-Code Database Builder - Stored XSSEPSS 0.3%CVE-2023-31995MEDIUMHanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Cross Site Scripting (XSS).EPSS 0.3%CVE-2023-4500MEDIUMOrder Tracking Pro <= 3.3.6 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-10227MEDIUMaffiliate-toolkit <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atkp_product ShortcodeEPSS 0.3%CVE-2024-41353HIGHphpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\groups\edit-group.phpEPSS 0.3%CVE-2026-1047MEDIUMsalavat counter Plugin <= 0.9.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'image_url' ParameterEPSS 0.3%CVE-2024-5380MEDIUMjsy-1 short-url admin.php cross site scriptingEPSS 0.3%CVE-2023-0025MEDIUMSAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an uEPSS 0.3%CVE-2023-6645MEDIUMPost Grid Combo – 36+ Gutenberg Blocks <= 2.2.64 - Authenticated (Contributor+) Cross-Site ScriptingEPSS 0.3%CVE-2023-6072MEDIUM A cross-site scripting vulnerability in Trellix Central Management (CM) prior to 9.1.3.97129 allows a remote authenticated attacker to crafEPSS 0.3%CVE-2024-8209MEDIUMnafisulbari/itsourcecode Insurance Management System addClient.php cross site scriptingEPSS 0.3%CVE-2024-10926MEDIUMIBPhoenix ibWebAdmin Tabelas Section toggle_fold_panel.php cross site scriptingEPSS 0.3%CVE-2024-54247MEDIUMWordPress ABCBiz Addons and Templates for Elementor plugin <= 2.0.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%