Weaknesses of type CWE-79

30,201 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-4391MEDIUMHappy Addons for Elementor Authenticated (Contributor+) Stored-XSS <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar WidgetEPSS 0.3%CVE-2024-20415MEDIUMA vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, reEPSS 0.3%CVE-2024-4087MEDIUMRoyal Elementor Addons and Templates <= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting via Back to Top WidgetEPSS 0.3%CVE-2024-9071MEDIUMEasy Demo Importer – A Modern One-Click Demo Import Solution <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-36674MEDIUMLyLme_spage v1.9.5 is vulnerable to Cross Site Scripting (XSS) via admin/link.php.EPSS 0.3%CVE-2024-2092MEDIUMElementor Addon Elements <= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter WidgetEPSS 0.3%CVE-2023-52192MEDIUMWordPress Keap Official Opt-in Forms Plugin <= 1.0.11 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-13153MEDIUMUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.135 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.3%CVE-2026-105644MEDIUMGhost: Stored XSS via SVG Files in Content ImportsEPSS 0.3%CVE-2024-4553MEDIUMWP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members ShortcodeEPSS 0.3%CVE-2026-1572MEDIUMLivemesh Addons by Elementor <= 9.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Plugin SettingsEPSS 0.3%CVE-2024-4626MEDIUMJetWidgets For Elementor <= 1.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_type and id ParametersEPSS 0.3%CVE-2024-4570MEDIUMElementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-40301MEDIUMrhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directivesEPSS 0.3%CVE-2024-5001MEDIUMImage Hover Effects for Elementor with Lightbox and Flipbox <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id, oxi_addons_f_title_tag, and content_description_tag ParametersEPSS 0.3%CVE-2023-0926MEDIUMCustom Permalinks <= 2.6.0 - Authenticated(Editor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-4329HIGHBlackhole for Bad Bots <= 3.8 - Unauthenticated Stored Cross-Site Scripting via User-Agent HTTP HeaderEPSS 0.3%CVE-2024-11930MEDIUMTaskbuilder – WordPress Project & Task Management plugin <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via wppm_tasks ShortcodeEPSS 0.3%CVE-2024-8208MEDIUMnafisulbari/itsourcecode Insurance Management System editClient.php cross site scriptingEPSS 0.3%CVE-2023-50879MEDIUMWordPress WordPress.com Editing Toolkit Plugin <= 3.78784 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%