Weaknesses of type CWE-79

30,188 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-25691MEDIUMBUG-000165286 - Reflected XSS in Portal for ArcGISEPSS 0.3%CVE-2024-4580MEDIUMMaster Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-8318MEDIUMAttributes for Blocks <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via attributesForBlocks ParameterEPSS 0.3%CVE-2024-4401MEDIUMElementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id and eae_slider_animation ParametersEPSS 0.3%CVE-2024-5192MEDIUMFunnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG UploadEPSS 0.3%CVE-2026-79799HIGHUnauthenticated Stored Cross-Site Scripting (XSS) Vulnerability in ClearPass Policy Manager Web-Based Management InterfaceEPSS 0.3%CVE-2021-47917MEDIUMSimple CMS 2.1 Persistent Cross-Site Scripting via User Input ParametersEPSS 0.3%CVE-2024-6929MEDIUMDynamic Featured Image <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dfiFeatured ParameterEPSS 0.3%CVE-2025-12739HIGHCross-Site Scripting (XSS) in Looker's Extension Loader leading to Admin Account CompromiseEPSS 0.3%CVE-2024-13377HIGHGravityForms <= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameterEPSS 0.3%CVE-2024-6575MEDIUMThe Plus Addons for Elementor <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TP Page Scroll WidgetEPSS 0.3%CVE-2024-4376MEDIUMPremium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text WidgetEPSS 0.3%CVE-2024-6629MEDIUMAll-in-One Video Gallery <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video ShortcodeEPSS 0.3%CVE-2024-0845MEDIUMPDF Viewer for Elementor <= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via renderEPSS 0.3%CVE-2024-5226MEDIUMFuse Social Floating Sidebar <= 5.4.10 - Authenticated (Author+) Stored Cross-Site Scripting via File UploadEPSS 0.3%CVE-2024-6870MEDIUMResponsive Lightbox & Gallery <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via File UploadEPSS 0.3%CVE-2024-38501MEDIUMPepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows HTML injectionEPSS 0.3%CVE-2025-11224HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%CVE-2024-4478MEDIUMHappy Addons for Elementor <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group WidgetEPSS 0.3%CVE-2024-4669MEDIUMEvents Addon for Elementor <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.3%