Weaknesses of type CWE-79

30,063 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-6532MEDIUMSheet to Table Live Sync for Google Sheet <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via STWT_Sheet_Table ShortcodeEPSS 0.3%CVE-2024-12768MEDIUMResponsive iframe <= 1.2.0 - Contributor+ Stored XSSEPSS 0.3%CVE-2024-4095MEDIUMCollapse-O-Matic <= 1.8.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-27188MEDIUMWordPress Breeze plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5205MEDIUMVideojs HTML5 Player <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via videojs_video ShortcodeEPSS 0.3%CVE-2024-8915MEDIUMCategory Icon <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-8919MEDIUMConfetti Fall Animation <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via confetti-fall-animation ShortcodeEPSS 0.3%CVE-2026-115534MEDIUMgedelumbung HospitalManagement Contact Form contact.php kirim cross site scriptingEPSS 0.3%CVE-2025-61074MEDIUMA stored Cross Site Scripting (XSS) vulnerability in the bulletin board (SchwarzeBrett) in adata Software GmbH Mitarbeiter Portal 2.15.2.0 aEPSS 0.3%CVE-2026-50742MEDIUMA stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Revive Adserver 6.0.7. TEPSS 0.3%CVE-2021-25656MEDIUMAvaya Aura Experience Portal XSS vulnerabilitiesEPSS 0.3%CVE-2024-27997MEDIUMWordPress Visual Composer plugin <= 45.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-8433MEDIUMEasy Mega Menu Plugin for WordPress – ThemeHunk <= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-3643MEDIUMMoodle: reflected xss risk in policy toolEPSS 0.3%CVE-2024-4980MEDIUMWPKoi Templates for Elementor <= 2.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple ParametersEPSS 0.3%CVE-2023-53918MEDIUMPodcastGenerator Stored Cross-Site Scripting via Episode Title FieldEPSS 0.3%CVE-2024-32126MEDIUMWordPress Navigation menu as dropdown Widget plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-6131MEDIUMCodeAstro Food Ordering System POST Request Parameter edit cross site scriptingEPSS 0.3%CVE-2026-30235MEDIUMBusiness Logic Error on OpenProject through hyperlinks in markdown using DOM clobberingEPSS 0.3%CVE-2024-4432MEDIUMPiotnet Addons For Elementor <= 2.4.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.3%