Weaknesses of type CWE-79

30,150 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-46934MEDIUMRocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to DOM-based Cross-site Scripting (XSS). Attackers may beEPSS 0.3%CVE-2025-0984HIGHArbitrary File Upload in Netoloji Software's E-FlowEPSS 0.3%CVE-2024-52467HIGHWordPress AI Responsive Gallery Album plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-56938MEDIUMLearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the materials-content class.EPSS 0.3%CVE-2024-1766MEDIUMDownload Manager <= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site ScriptingEPSS 0.3%CVE-2024-5279MEDIUMQiwen Netdisk File Rename cross site scriptingEPSS 0.3%CVE-2024-20512MEDIUMCisco Unified Contact Center Management Portal Reflected Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2026-49220MEDIUMJellyfin: Potential XSS in user managementEPSS 0.3%CVE-2024-31255HIGHWordPress ELEX WooCommerce Dynamic Pricing and Discounts plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-4486MEDIUMAwesome Contact Form7 for Elementor <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via AEP Contact Form 7 WidgetEPSS 0.3%CVE-2024-56939MEDIUMLearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the ld-comment-body class.EPSS 0.3%CVE-2025-4986HIGHStored Cross-site Scripting (XSS) vulnerability affecting Model Definition in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025xEPSS 0.3%CVE-2025-4991HIGHStored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025xEPSS 0.3%CVE-2024-42904MEDIUMA cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows attackers to execute arbitrary web scripts or HTML via injecting a crafteEPSS 0.3%CVE-2024-22307HIGHWordPress WP-Lister Lite for eBay plugin <= 3.5.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-20511MEDIUMCisco Unified Communications Manager Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2024-5554MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-3231HIGHCheckout Field Editor (Checkout Manager) for WooCommerce <= 2.1.7 - Unauthenticated Stored Cross-Site Scripting via Block Checkout Custom Radio FieldEPSS 0.3%CVE-2024-29930MEDIUMWordPress Crypto Converter Widget plugin <= 1.8.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-3149MEDIUMitning Student Homework Management System Edit Job Page fileupload cross site scriptingEPSS 0.3%