Weaknesses of type CWE-79

30,150 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-3230MEDIUMDownload Attachments <= 1.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-33946HIGHWordPress WPify Woo Czech plugin <= 4.0.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-49965MEDIUMSpaceX Starlink Wi-Fi router Gen 2 before 2023.48.0 allows XSS via the ssid and password parameters on the Setup Page.EPSS 0.3%CVE-2025-4989HIGHStored Cross-site Scripting (XSS) vulnerability affecting Requirements in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025xEPSS 0.3%CVE-2024-28100HIGHStored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftwEPSS 0.3%CVE-2024-29103HIGHWordPress Database for Contact Form 7 plugin <= 3.0.6 - Unauthenticated Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-21944MEDIUMVulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality ManageEPSS 0.3%CVE-2024-7489MEDIUMForms for Mailchimp by Optin Cat <= 2.5.7 - Authenticated (Editor+) Stored Cross-Site Scripting via Form Color ParametersEPSS 0.3%CVE-2025-22682HIGHWordPress Hesabfa Accounting Plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2022-36277MEDIUMSQL injection vulnerability in TCMAN GIMEPSS 0.3%CVE-2025-10316LOWCross-Site Scripting in extension "Form to Database" (form_to_database)EPSS 0.3%CVE-2025-8153MEDIUMCross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.1EPSS 0.3%CVE-2025-24620HIGHWordPress AIO Shortcodes plugin <= 1.3 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-4984HIGHStored Cross-site Scripting (XSS) vulnerability affecting City Discover in City Referential Manager on Release 3DEXPERIENCE R2025xEPSS 0.3%CVE-2023-48682MEDIUMStored cross-site scripting (XSS) vulnerability in unit name. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows)EPSS 0.3%CVE-2024-25921HIGHWordPress Action Network plugin <= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-52482HIGHWordPress Ortto plugin <= 1.0.19 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-12223CRITICALStored Cross-site Scripting (XSS) in Nutanix Prism CentralEPSS 0.3%CVE-2025-0485MEDIUMFanli2012 native-php-cms sysconfig_doedit.php cross site scriptingEPSS 0.3%CVE-2026-22257HIGHSalvo is vulnerable to stored XSS in the list_html function by uploading files with malicious namesEPSS 0.3%