Weaknesses of type CWE-79

30,223 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-35352MEDIUMA vulnerability has been discovered in Diño Physics School Assistant version 2.3. This vulnerability impacts unidentified code within the fiEPSS 0.3%CVE-2024-55239MEDIUMA reflected Cross-Site Scripting vulnerability in the standard documentation upload functionality in Portabilis i-Educar 2.9 allows attackerEPSS 0.3%CVE-2024-11756MEDIUMSweepWidget Contests, Giveaways, Photo Contests, Competitions <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-53924MEDIUMEmlog vulnerable to stored Cross-site Scripting in links functionalityEPSS 0.3%CVE-2023-47526MEDIUMWordPress Chartify Plugin <= 2.0.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-24717MEDIUMWordPress Beds24 Online Booking Plugin <= 2.0.23 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-50183MEDIUMOpenList (frontend) allows XSS Attacks in the built-in Markdown ViewerEPSS 0.3%CVE-2024-12816MEDIUMNOTICE BOARD BY TOWKIR <= 3.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-30160MEDIUMA vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with EPSS 0.3%CVE-2025-3752MEDIUMAble Player, accessible HTML5 media player <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via preload ParameterEPSS 0.3%CVE-2026-30917HIGHStored XSS on Bucket namespace pagesEPSS 0.3%CVE-2026-57279MEDIUMCybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the EPSS 0.3%CVE-2024-29106MEDIUMWordPress Premium Addons for Elementor plugin <= 4.10.16 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-52203MEDIUMWordPress CformsII Plugin <= 15.0.5 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-22306MEDIUMWordPress Mang Board WP Plugin <= 1.7.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-47610HIGHStored Cross-site Scripting Vulnerability in Markdown EditorEPSS 0.3%CVE-2023-50830MEDIUMWordPress Seos Contact Form Plugin <= 1.8.0 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2018-25116MEDIUMMyBB Thread Redirect Plugin 0.2.1 - Cross-Site ScriptingEPSS 0.3%CVE-2025-8920MEDIUMPortabilis i-Diario Dicionário de Termos BNCC dicionario-de-termos-bncc cross site scriptingEPSS 0.3%CVE-2026-100383MEDIUMStored i18n XSS in WikiLambda's VisualEditor integrationEPSS 0.3%