Weaknesses of type CWE-79

30,184 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-57599MEDIUMCross Site Scripting vulnerability in DouPHP v.1.8 Release 20231203 allows attackers to execute arbitrary code via a crafted payload injecteEPSS 0.3%CVE-2025-5529MEDIUMEducenter <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-8507MEDIUMPortabilis i-Educar educar_funcao_lst.php cross site scriptingEPSS 0.3%CVE-2024-13380MEDIUMAlex Reservations: Smart Restaurant Booking <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-56365HIGHPhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader classEPSS 0.3%CVE-2024-34954MEDIUMCode-projects Budget Management 1.0 is vulnerable to Cross Site Scripting (XSS) via the budget parameter.EPSS 0.3%CVE-2023-43065MEDIUM Dell Unity prior to 5.3 contains a Cross-site scripting vulnerability. A low-privileged authenticated attacker can exploit these issues to EPSS 0.3%CVE-2025-5587MEDIUMAppzend <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via progressbarLayout ParameterEPSS 0.3%CVE-2023-51415MEDIUMWordPress GiveWP Plugin <= 3.2.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-2697MEDIUMSwift Framework < 2024.0.0 - Contributor+ Stored XSS via ShortcodeEPSS 0.3%CVE-2025-40722MEDIUMStored Cross-Site Scripting (XSS) vulnerability on FlatboardEPSS 0.3%CVE-2024-10652MEDIUMCHANGING Information Technology IDExpert - Reflected XSSEPSS 0.3%CVE-2024-8857MEDIUMWordPress Auction <= 3.7 - Editor+ Stored XSSEPSS 0.3%CVE-2025-2540MEDIUMMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via prettyPhoto JavaScript LibraryEPSS 0.3%CVE-2024-53709MEDIUMWordPress Generic Elements plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-26930HIGHSmarterTools SmarterMail before 9526 allows XSS via MAPI requests.EPSS 0.3%CVE-2025-7618MEDIUMA stored Cross-Site Scripting (XSS) vulnerability exists in the File Explorer and Text Editor of ADMEPSS 0.3%CVE-2025-49312HIGHWordPress Echo RSS Feed Post Generator Plugin for WordPress plugin <= 5.4.8.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-42235HIGHn8n: XSS via MCP OAuth clientEPSS 0.3%CVE-2026-32277HIGHConnect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List ViewEPSS 0.3%