Weaknesses of type CWE-79

30,150 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-35234MEDIUMDiscourse vulnerable to stored-dom XSS via Facebook OneboxesEPSS 0.3%CVE-2025-67823HIGHA vulnerability in the Multimedia Email component of Mitel MiContact Center Business through 10.2.0.10 and Mitel CX through 1.1.0.1 could alEPSS 0.3%CVE-2023-46074MEDIUMWordPress FreshMail For WordPress Plugin <= 2.3.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-10178MEDIUMGutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.3%CVE-2024-3889MEDIUMRoyal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Accordion Title TagsEPSS 0.3%CVE-2024-24801MEDIUMWordPress OWL Carousel Plugin <= 1.4.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-9353MEDIUMThemify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-57440HIGHMediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabledEPSS 0.3%CVE-2026-30562CRITICALA Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located iEPSS 0.3%CVE-2025-2635MEDIUMDigital License Manager <= 1.7.3 - Reflected Cross-Site Scripting via remove_query_arg FunctionEPSS 0.3%CVE-2024-32570HIGHWordPress Cornerstone plugin <= 0.8.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-56299HIGHWordPress Notify Odoo plugin <= 1.0.0 - CSRF to Stored XSS vulnerabilityEPSS 0.3%CVE-2024-54774MEDIUMDcat Admin v2.2.0-beta contains a cross-site scripting (XSS) vulnerability in /admin/articles/create.EPSS 0.3%CVE-2025-3613MEDIUMDemtec Graphytics visualization cross site scriptingEPSS 0.3%CVE-2025-47056MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2026-3368HIGHInjection Guard <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via Query Parameter NameEPSS 0.3%CVE-2025-47005MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2024-3559MEDIUMCustom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_content]EPSS 0.3%CVE-2024-56016HIGHWordPress Image Mapper plugin <= 0.2.5.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-51646HIGHWordPress Saoshyant Element plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%