Weaknesses of type CWE-79

30,149 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-13082MEDIUMPHPGurukul Land Record System search-property.php cross site scriptingEPSS 0.3%CVE-2024-8720MEDIUMRumbleTalk Live Group Chat – HTML5 <= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2019-25403MEDIUMComodo Dome Firewall 2.7.0 Stored Cross-Site Scripting via admin_profilesEPSS 0.3%CVE-2025-9737MEDIUMO2OA Personal Profile importmodel cross site scriptingEPSS 0.3%CVE-2025-71241MEDIUMSPIP < 4.3.6 Cross-Site Scripting in Private AreaEPSS 0.3%CVE-2024-20538MEDIUMCisco Identity Services Engine Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2024-32429MEDIUMWordPress Remove Footer Credit plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7870MEDIUMPortabilis i-Diario justificativas-de-falta Endpoint doc_uploader.rb cross site scriptingEPSS 0.3%CVE-2026-45665HIGHOpen WebUI: Stored XSS in Banner Component via Improper Sanitization OrderEPSS 0.3%CVE-2024-29103HIGHWordPress Database for Contact Form 7 plugin <= 3.0.6 - Unauthenticated Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-48682MEDIUMStored cross-site scripting (XSS) vulnerability in unit name. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows)EPSS 0.3%CVE-2024-5946MEDIUMSquelch Tabs and Accordions Shortcodes <= 0.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via tab ShortcodeEPSS 0.3%CVE-2024-9051MEDIUMWP Ultimate Post Grid <= 3.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-grid-with-filters ShortcodeEPSS 0.3%CVE-2024-11935MEDIUMEmail Address Obfuscation <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via class ParameterEPSS 0.3%CVE-2025-4984HIGHStored Cross-site Scripting (XSS) vulnerability affecting City Discover in City Referential Manager on Release 3DEXPERIENCE R2025xEPSS 0.3%CVE-2024-30551HIGHWordPress Sticky Anything plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-6897MEDIUMaThemes Starter Sites <= 1.0.53 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-8153MEDIUMCross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.1EPSS 0.3%CVE-2022-36277MEDIUMSQL injection vulnerability in TCMAN GIMEPSS 0.3%CVE-2024-25921HIGHWordPress Action Network plugin <= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%