Weaknesses of type CWE-79

30,065 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-62698MEDIUMStored XSS through system messages in ExternalGuidanceEPSS 0.3%CVE-2026-76326MEDIUMStored Cross-Site Scripting through Dashboard Sparkline Tooltip Options in Splunk EnterpriseEPSS 0.3%CVE-2024-39728MEDIUMIBM Datacap Navigator cross-site scriptingEPSS 0.3%CVE-2023-32089MEDIUM Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description EPSS 0.3%CVE-2024-13711MEDIUMPollin <= 1.01.1 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2026-88618MEDIUM1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attaEPSS 0.3%CVE-2023-3588MEDIUMStored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022xEPSS 0.3%CVE-2023-34374MEDIUMWordPress AnsPress – Question and answer Plugin <= 4.3.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2023-38423MEDIUMBIG-IP Configuration utility vulnerabilityEPSS 0.3%CVE-2024-35239LOWStored Cross-site Scripting on Components of Umbraco FormsEPSS 0.3%CVE-2024-3638MEDIUMElementor Addons by Livemesh <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marquee Text Widget, Testimonials Widget, and Testimonial Slider WidgetsEPSS 0.3%CVE-2024-5419MEDIUMVoid Contact Form 7 Widget For Elementor Page Builder <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7_redirect_page AttributeEPSS 0.3%CVE-2022-42452MEDIUMHCL Launch is vulnerable to HTML injection.  HTML code is stored and included without being sanitized. This can lead to further attacks suchEPSS 0.3%CVE-2024-12069MEDIUMLexicata <= 1.0.16 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2020-7317MEDIUMePolicy Orchistrator (ePO) - Cross-Site Scripting vulnerabilityEPSS 0.3%CVE-2023-23954MEDIUMAdvanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Stored Cross-Site Scripting vulnerabilityEPSS 0.3%CVE-2024-1097HIGHStored XSS in craigk5n/webcalendarEPSS 0.3%CVE-2024-1427MEDIUMThe Post Grid <= 7.7.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via section title tagEPSS 0.3%CVE-2024-48396MEDIUMAIML Chatbot 1.0 (fixed in 2.0) is vulnerable to Cross Site Scripting (XSS). The vulnerability is exploited through the message input field,EPSS 0.3%CVE-2024-5219MEDIUMEasy Google Maps <= 1.11.15 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.3%