Weaknesses of type CWE-79

30,191 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-2253MEDIUMTestimonial Carousel For Elementor <= 10.2.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-20204MEDIUMMultiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) guest portals could allow an authentiEPSS 0.3%CVE-2025-24723MEDIUMWordPress Booking Calendar Contact Form Plugin <= 1.2.55 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22724MEDIUMWordPress Product Carousel For WooCommerce – WoorouSell plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-44009HIGHWordPress WCFM Marketplace <= 3.6.11 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-12211MEDIUMPega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile.EPSS 0.3%CVE-2024-5501MEDIUMSupreme Modules Lite – Divi Theme, Extra Theme and Divi Builder <= 2.5.51 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-54759HIGHSiYuan: Lute HTML sanitizer allows `<iframe>` tags in Bazaar package README, leading to arbitrary command execution via SiYuan Electron clientEPSS 0.3%CVE-2024-50407HIGHWordPress Namaste! LMS plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-7355MEDIUMOrganization chart <= 1.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via title_input and node_description ParametersEPSS 0.3%CVE-2025-57692MEDIUMPiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution ofEPSS 0.3%CVE-2024-11830MEDIUMDear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.52 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-41960LOWCross-site Scripting (XSS) via Relay Hosts Configuration in mailcow: dockerizedEPSS 0.3%CVE-2025-0595HIGHStored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2025-30087HIGHBest Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted parameters in a search URL.EPSS 0.3%CVE-2026-4142MEDIUMSentence To SEO (keywords, description and tags) <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Permanent keywords' FieldEPSS 0.3%CVE-2024-11451MEDIUMZooom <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-6977MEDIUMProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' functionEPSS 0.3%CVE-2024-37803MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in CodeProjects Health Care hospital Management System v1.0 allows attackers to eEPSS 0.3%CVE-2025-1679MEDIUMCross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject maliciEPSS 0.3%