Weaknesses of type CWE-79

30,149 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-5727MEDIUMSourceCodester Student Result Management System Announcement Page announcement cross site scriptingEPSS 0.3%CVE-2025-5584MEDIUMPHPGurukul Hospital Management System POST Parameter edit-patient.php cross site scriptingEPSS 0.3%CVE-2024-20525MEDIUMCisco Identity Services Engine Reflected Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2023-51361MEDIUMWordPress Sticky Chat Widget Plugin <= 1.1.8 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2026-10104MEDIUMProduct Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail ParameterEPSS 0.3%CVE-2024-43024MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in RWS MultiTrans v7.0.23324.2 and earlier allow attackers to execute arbitrary wEPSS 0.3%CVE-2026-2834HIGHAge Verification & Identity Verification by Token of Trust <= 3.32.3 - Unauthenticated Stored Cross-Site Scripting via 'description' ParameterEPSS 0.3%CVE-2024-54043MEDIUMAdobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.3%CVE-2024-10112MEDIUMSimple News <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via news ShortcodeEPSS 0.3%CVE-2023-6776MEDIUM3D Flipbook <= 1.15.2 - Authenticated (Contributor+) Cross-Site Scripting via Ready FunctionEPSS 0.3%CVE-2026-12108MEDIUMHighlighting Code Block <= 2.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'font_family' SettingEPSS 0.3%CVE-2024-1508MEDIUMPrime Slider – Addons For Elementor <= 3.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Mercury WidgetEPSS 0.3%CVE-2025-51860MEDIUMStored Cross-Site Scripting (XSS) in TelegAI (telegai.com) 2025-05-26 in its chat component and character container component. An attacker cEPSS 0.3%CVE-2025-52203HIGHA stored cross-site scripting (XSS) vulnerability exists in DevaslanPHP project-management v1.2.4. The vulnerability resides in the Ticket NEPSS 0.3%CVE-2024-47612LOWXSS in Special:DataDump when displaying dump statusEPSS 0.3%CVE-2024-32428MEDIUMWordPress MWW Disclaimer Buttons plugin <= 3.0.2 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-39933MEDIUMMultiple XSS vulnerabilities in GlobalWatchlistEPSS 0.3%CVE-2024-44001MEDIUMWordPress Royal Elementor Addons and Templates plugin <= 1.3.982 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-54048MEDIUMAdobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.3%CVE-2025-5726MEDIUMSourceCodester Student Result Management System Division System Page division-system cross site scriptingEPSS 0.3%