Weaknesses of type CWE-79

30,190 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-2633MEDIUMMultiple vulnerabilities on Meta4 HR from CegidEPSS 0.3%CVE-2026-73641MEDIUMMultiple Reflected XSS in Dayforce ESS ExcelityEPSS 0.3%CVE-2024-11379MEDIUMBroadcast <= 51.01 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2024-48933MEDIUMA cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.19.3 allows remote attackers to inject arbitrary web script or HTML intEPSS 0.3%CVE-2024-27728MEDIUMCross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the text parameter ofEPSS 0.3%CVE-2025-7140MEDIUMSourceCodester Best Salon Management System Update Staff Page edit-staff.php cross site scriptingEPSS 0.3%CVE-2026-42849CRITICALauthentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeoverEPSS 0.3%CVE-2026-76704MEDIUMAuthenticated Stored Cross-Site Scripting (XSS) Vulnerability in EdgeConnect SD-WAN Orchestrator Web-Based Management InterfaceEPSS 0.3%CVE-2024-37487HIGHWordPress WP Directory Kit plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-50040MEDIUMCross-site Scripting in StoneFly Storage ConcentratorEPSS 0.3%CVE-2024-50448HIGHWordPress YITH WooCommerce Product Add-Ons plugin <= 4.14.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-50133MEDIUMHugo: XSS via text/html content filesEPSS 0.3%CVE-2024-37461HIGHWordPress IdeaPush plugin <= 8.65 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-41706HIGHA stored XSS issue was discovered in Archer Platform 6 before version 2024.06. A remote authenticated malicious Archer user could potentiallEPSS 0.3%CVE-2024-28793MEDIUMIBM Engineering Workflow Management cross-site scriptingEPSS 0.3%CVE-2015-20118MEDIUMRealtyScript 4.0.2 Stored Cross-Site Scripting via location_name ParameterEPSS 0.3%CVE-2024-47389HIGHWordPress NEX-Forms plugin <= 8.7.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-37933HIGHAn improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiADC GUI version 7.4.0EPSS 0.3%CVE-2024-47638HIGHWordPress Online Booking & Scheduling Calendar for WordPress plugin <= 4.4.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-40262MEDIUMAn issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows unauthenticated Stored Cross-Site ScriptEPSS 0.3%