Weaknesses of type CWE-79

30,063 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-25199MEDIUMA reflected cross-site scripting (XSS) vulnerability exists in the MT Safeline X-Ray X3310 webserver version NXG 19.05 that enables a remoteEPSS 0.3%CVE-2024-1419MEDIUMThe Plus Addons for Elementor <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Header Meta Content WidgetEPSS 0.3%CVE-2026-84739HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%CVE-2025-13993MEDIUMMailerLite – Signup forms (official) <= 1.7.16 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-1506MEDIUMPrime Slider – Addons For Elementor <= 3.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fiestar WidgetEPSS 0.3%CVE-2026-30974MEDIUMCopyparty volflag `nohtml` did not block javascript in svg filesEPSS 0.3%CVE-2024-10080MEDIUMWP Easy Post Types <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post MetaEPSS 0.3%CVE-2023-31862MEDIUMjizhicms v2.4.6 is vulnerable to Cross Site Scripting (XSS). The content of the article published in the front end is only filtered in the fEPSS 0.3%CVE-2023-50892HIGHWordPress TheGem Theme <= 5.9.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-45715HIGHSolarWinds Platform Edit Function Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2024-49211MEDIUMReflected XSS was discovered in a Dashboard Listing Archer Platform UX page in Archer Platform 6.x before version 2024.08. A remote unauthenEPSS 0.3%CVE-2023-45908MEDIUMHomarr before v0.14.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notebook widget.EPSS 0.3%CVE-2024-26557MEDIUMCodiad v2.8.4 allows reflected XSS via the components/market/dialog.php type parameter.EPSS 0.3%CVE-2026-28338MEDIUMPMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messagesEPSS 0.3%CVE-2023-39223MEDIUMStored cross-site scripting vulnerability exists in CGIs included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerabiliEPSS 0.3%CVE-2024-3343MEDIUMOtter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block AttributesEPSS 0.3%CVE-2025-26626MEDIUMGLPI Inventory Plugin vulnerable to reflective Cross-site ScriptingEPSS 0.3%CVE-2024-49210MEDIUMReflected XSS was discovered in an iView List Archer Platform UX page in Archer Platform 6.x before version 2024.09. A remote unauthenticateEPSS 0.3%CVE-2023-44315MEDIUMA vulnerability has been identified in SINEC NMS (All versions < V2.0). The affected application improperly sanitizes certain SNMP configuraEPSS 0.3%CVE-2026-4992MEDIUMwandb OpenUI HTMLAnnotator server.py get_share HTML injectionEPSS 0.3%