Weaknesses of type CWE-79

30,201 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-20409MEDIUMA vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, reEPSS 0.3%CVE-2024-9306MEDIUMWP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-9708MEDIUMEasy SVG Upload <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-4667MEDIUMBlog, Posts and Category Filter for Elementor <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post and Category Filter WidgetEPSS 0.3%CVE-2024-29095MEDIUMWordPress Site Reviews plugin <= 6.11.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-10323MEDIUMJetWidgets For Elementor <= 1.0.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-6363MEDIUMStock Ticker <= 3.24.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock_ticker ShortcodeEPSS 0.3%CVE-2026-3659MEDIUMWP Circliful <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode AttributeEPSS 0.3%CVE-2024-8960MEDIUMCowidgets – Elementor Addons <= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-67025MEDIUMCross Site Scripting vulnerability in Anycomment anycomment.io 0.4.4 allows a remote attacker to execute arbitrary code via the Anycomment cEPSS 0.3%CVE-2024-6282MEDIUMMaster Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-jltma-wrapper-link ElementEPSS 0.3%CVE-2025-1291MEDIUMGutenberg Blocks by Kadence Blocks <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon'EPSS 0.3%CVE-2024-4273MEDIUMEssential Real Estate <= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2026-28861MEDIUMA logic issue was addressed with improved state management. This issue is fixed in Safari 26.4, iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iEPSS 0.3%CVE-2024-44930MEDIUMSerilog before v2.1.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by EPSS 0.3%CVE-2024-4379MEDIUMPremium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Global TooltipEPSS 0.3%CVE-2026-107751HIGHMang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' ParameterEPSS 0.3%CVE-2026-87901HIGHImproper sanitization in the registration module allows reflected Cross-Site Scripting.EPSS 0.3%CVE-2024-4313MEDIUMTable Addons for Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id ParameterEPSS 0.3%CVE-2024-3926MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom_attributesEPSS 0.3%