Weaknesses of type CWE-79

30,100 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-32690MEDIUMWordPress RSS Feed Widget plugin <= 2.9.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-10886MEDIUMTribute Testimonials – WordPress Testimonial Grid/Slider <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-38446MEDIUMA stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field. UsEPSS 0.3%CVE-2026-29173LOWCraft Commerce has Stored XSS while updating Order Status from Orders TableEPSS 0.3%CVE-2026-103662MEDIUMMISP Reflected XSS in Taxonomy Tag Confirmation FormsEPSS 0.3%CVE-2026-10289MEDIUMcode-projects Hotel and Tourism Reservation System tour.php cross site scriptingEPSS 0.3%CVE-2026-61526MEDIUMAdonisJS HTTP Server is vulnerable to reflected XSS through its exception handlerEPSS 0.3%CVE-2024-10894MEDIUMPayment Forms for Paystack <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-28380MEDIUMA cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injeEPSS 0.3%CVE-2026-52772MEDIUMYesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`)EPSS 0.3%CVE-2024-28798HIGHIBM InfoSphere Information Server cross-site scriptingEPSS 0.3%CVE-2024-33943MEDIUMWordPress Ultimate Under Construction plugin <= 1.9.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32585MEDIUMWordPress Import Content in WordPress & WooCommerce with Excel plugin <= 4.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-2509HIGHA Cross-Site Scripting(XSS) vulnerability was found on ADMEPSS 0.3%CVE-2023-43962MEDIUMCross Site Scripting vulnerability in Xunrui CMS Public Edition v.4.6.1 allows a remote attacker to execute arbitrary code via the project nEPSS 0.3%CVE-2023-53880MEDIUMLucee 5.4.2.17 Authenticated Reflected Cross-Site Scripting via Admin InterfacesEPSS 0.3%CVE-2024-33695MEDIUMWordPress Fan Page Widget by ThemeNcode plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-4093MEDIUMReflected and persistent XSS vulnerability in Fujitsu Arconte ÁureaEPSS 0.3%CVE-2023-23856MEDIUMIn SAP BusinessObjects Business Intelligence (Web Intelligence user interface) - version 430, some calls return json with wrong content typeEPSS 0.3%CVE-2026-40507MEDIUMOpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient PortalEPSS 0.3%