Weaknesses of type CWE-79

30,188 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-6870MEDIUMResponsive Lightbox & Gallery <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via File UploadEPSS 0.3%CVE-2024-8967MEDIUMPWA — easy way to Progressive Web App <= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-4700MEDIUMWP Table Builder – WordPress Table Plugin <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-38501MEDIUMPepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows HTML injectionEPSS 0.3%CVE-2024-7778MEDIUMOrbit Fox by ThemeIsle <= 2.10.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-6894MEDIUMRD Station <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2022-4975HIGHRhacs: cross-site scripting in portalEPSS 0.3%CVE-2024-9444MEDIUMElementsReady Addons for Elementor <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-38038MEDIUMBUG-000165732 - Reflected XSS in Portal for ArcGISEPSS 0.3%CVE-2024-13827MEDIUMRazorpay Subscription Button Elementor Plugin <= 1.0.3 - Reflected Cross-Site Scripting via add_query_arg and remove_query_arg FunctionsEPSS 0.3%CVE-2025-5542MEDIUMTOTOLINK X2000R Virtual Server Page formPortFw cross site scriptingEPSS 0.3%CVE-2025-11224HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%CVE-2024-4378MEDIUMPremium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Menu and Shape DividerEPSS 0.3%CVE-2024-7353MEDIUMAccept Stripe Payments <= 2.0.86 - Authenticated (Contributor+) Stored Cross-Site Scripting via accept_stripe_payment_ng ShortcodeEPSS 0.3%CVE-2024-3801MEDIUMXSS in S@M CMSEPSS 0.3%CVE-2024-7606MEDIUMFront End Users <= 3.2.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-7791MEDIUM140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Grid WidgetEPSS 0.3%CVE-2024-8282MEDIUMIbtana – WordPress Website Builder <= 1.2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align AttributeEPSS 0.3%CVE-2025-53626MEDIUMpdfme has Sandbox Escape and Prototype Pollution vulnerabilities in pdfme expression evaluationEPSS 0.3%CVE-2024-5073MEDIUMEssential Addons for Elementor <= 5.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter FeedEPSS 0.3%