Weaknesses of type CWE-79

30,194 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-53277MEDIUMCross-site Scripting in form messages in silverstripe frameworkEPSS 0.3%CVE-2024-21897HIGHQTS, QuTS heroEPSS 0.3%CVE-2026-76475CRITICALCisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting VulnerabilitiesEPSS 0.3%CVE-2025-6977MEDIUMProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' functionEPSS 0.3%CVE-2024-5611MEDIUMStratum – Elementor Widgets <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetEPSS 0.3%CVE-2026-18099HIGHIBM i is Affected By Multiple Vulnerabilities in Navigator for iEPSS 0.3%CVE-2026-4142MEDIUMSentence To SEO (keywords, description and tags) <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Permanent keywords' FieldEPSS 0.3%CVE-2024-8734MEDIUMLucas String Replace <= 2.0.5 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-3661MEDIUMSB Chart block <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via className ParameterEPSS 0.3%CVE-2026-43980MEDIUMMalla: Stored XSS via Meshtastic node names in multiple frontend pagesEPSS 0.3%CVE-2024-20475MEDIUMCisco SD-WAN vManage Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2024-50577MEDIUMIn JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settingsEPSS 0.3%CVE-2025-10253MEDIUMopenDCIM SVG File uploadifive.php cross site scriptingEPSS 0.3%CVE-2024-53307MEDIUMA reflected cross-site scripting (XSS) vulnerability in the /mw/ endpoint of Evisions MAPS v6.10.2.267 allows attackers to execute arbitraryEPSS 0.3%CVE-2025-3814MEDIUMTax Switch for WooCommerce <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via class-name ParameterEPSS 0.3%CVE-2023-47525MEDIUMWordPress Event Management Tickets Booking Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-32960MEDIUMCUBA Generic REST API Vulnerable to Cross-Site Scripting (XSS) in the /files EndpointEPSS 0.3%CVE-2024-1166MEDIUMImage Hover Effects - Elementor Addon <= 1.4.1 - Authenticated(Contributor+) DOM-based Stored Cross-Site Scripting via Image Hover Effects WidgetEPSS 0.3%CVE-2024-12126MEDIUMSEO Keywords <= 1.1.3 - Reflected Cross-Site Scripting via google_error ParameterEPSS 0.3%CVE-2024-43233HIGHWordPress BSK Forms Blacklist plugin <= 3.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%