Weaknesses of type CWE-79

30,188 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-3801MEDIUMXSS in S@M CMSEPSS 0.3%CVE-2024-4364MEDIUMQi Addons For Elementor <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button WidgetEPSS 0.3%CVE-2026-116752MEDIUMGeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter InjectionEPSS 0.3%CVE-2024-7356MEDIUMZephyr Project Manager <= 3.3.100 - Authenticated (Subscriber+) Stored Cross-Site Scripting via filename ParameterEPSS 0.3%CVE-2024-7353MEDIUMAccept Stripe Payments <= 2.0.86 - Authenticated (Contributor+) Stored Cross-Site Scripting via accept_stripe_payment_ng ShortcodeEPSS 0.3%CVE-2024-38501MEDIUMPepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows HTML injectionEPSS 0.3%CVE-2024-5073MEDIUMEssential Addons for Elementor <= 5.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter FeedEPSS 0.3%CVE-2024-13827MEDIUMRazorpay Subscription Button Elementor Plugin <= 1.0.3 - Reflected Cross-Site Scripting via add_query_arg and remove_query_arg FunctionsEPSS 0.3%CVE-2024-4700MEDIUMWP Table Builder – WordPress Table Plugin <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-2946CRITICALCross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data Tool of pgAdmin 4EPSS 0.3%CVE-2022-4975HIGHRhacs: cross-site scripting in portalEPSS 0.3%CVE-2024-8967MEDIUMPWA — easy way to Progressive Web App <= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-11224HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%CVE-2024-7791MEDIUM140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Grid WidgetEPSS 0.3%CVE-2024-9444MEDIUMElementsReady Addons for Elementor <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-4478MEDIUMHappy Addons for Elementor <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group WidgetEPSS 0.3%CVE-2026-2947MEDIUMrymcu forest User Profile UserInfoController.java updateUserInfo cross site scriptingEPSS 0.3%CVE-2024-2350MEDIUMClever Addons for Elementor <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple CAFE WidgetsEPSS 0.3%CVE-2024-5663MEDIUMCards for Beaver Builder <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Cards WidgetEPSS 0.3%CVE-2025-67906MEDIUMIn MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.EPSS 0.3%