Weaknesses of type CWE-79

30,199 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-3966MEDIUMPray For Me <= 1.0.4 - Unauthenticated Stored XSSEPSS 0.3%CVE-2024-55635MEDIUMDrupal core - Critical - Cross Site Scripting - SA-CORE-2024-005EPSS 0.3%CVE-2023-44915HIGHA cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scripEPSS 0.3%CVE-2026-44651MEDIUMSillyTavern: Reflected XSS vulnerability in the CORS proxy middlewareEPSS 0.3%CVE-2026-55230HIGHVvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than characterEPSS 0.3%CVE-2025-56154MEDIUMhtmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in the /author/:name endpoint of the affected application. The name parameter is noEPSS 0.3%CVE-2025-5651MEDIUMcode-projects Traffic Offense Reporting System saveuser.php cross site scriptingEPSS 0.3%CVE-2024-22130HIGHCross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UIEPSS 0.3%CVE-2025-49461MEDIUMZoom Workplace Clients - Cross-site ScriptingEPSS 0.3%CVE-2024-13868MEDIUMEasy Broken Link Checker <= 9.0.2 - Reflected XSSEPSS 0.3%CVE-2026-82890MEDIUMIBM Guardium Data Protection is affected by multiple vulnerabilities.EPSS 0.3%CVE-2024-32566MEDIUMWordPress WP Club Manager plugin <= 2.2.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-10342MEDIUMLeague of Legends Shortcodes <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2026-34568CRITICALCI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.3%CVE-2026-27196HIGHStatamic affected by privilege escalation via stored Cross-site ScriptingEPSS 0.3%CVE-2024-32564MEDIUMWordPress PostX plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-6498MEDIUMComplianz | GDPR/CCPA Cookie Consent <= 6.5.5 - Authenticated(Administrator+) Stored Cross-site Scripting via settingsEPSS 0.3%CVE-2025-52358MEDIUMA cross-site scripting vulnerability in Vivaldi United Group iCONTROL+ Server including Firmware version 4.7.8.0.eden Logic version 5.32 andEPSS 0.3%CVE-2024-24097MEDIUMCross Site Scripting (XSS) vulnerability in Code-projects Scholars Tracking System 1.0 allows attackers to run arbitrary code via the News FEPSS 0.3%CVE-2025-1490MEDIUMSmart Maintenance Mode <= 1.5.2 - Reflected Cross-Site Scripting via setstatus ParameterEPSS 0.3%