Weaknesses of type CWE-79

30,237 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-45800MEDIUMMultiple mXSS found in snappymail HTML parserEPSS 0.3%CVE-2025-54300HIGHExtension - norrnext.com - Stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for JoomlaEPSS 0.3%CVE-2025-2314MEDIUMUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-4489MEDIUMRoyal Elementor Addons and Templates <= 1.3.976 - Authenticated (Author+) Stored Cross-Site Scripting via SVG UploadsEPSS 0.3%CVE-2026-1985MEDIUMPress3D <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Link URL Parameter in 3D Model BlockEPSS 0.3%CVE-2026-30238MEDIUMGroup-Office: Reflected XSS in JavaScript contextEPSS 0.3%CVE-2026-72832MEDIUMGrav before 2.0.13 Stored XSS via quoted-attribute bypassEPSS 0.3%CVE-2026-3610MEDIUMHSC Cybersecurity Mailinspector URL mliUserValidation.php cross site scriptingEPSS 0.3%CVE-2024-5426MEDIUMPhoto Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Zipped SVGEPSS 0.3%CVE-2025-52357MEDIUMCross-Site Scripting (XSS) vulnerability exists in the ping diagnostic feature of FiberHome FD602GW-DX-R410 router (firmware V2.2.14), allowEPSS 0.3%CVE-2022-45176MEDIUMAn issue was discovered in LIVEBOX Collaboration vDesk through v018. Stored Cross-site Scripting (XSS) can occur under the /api/v1/getbodyfiEPSS 0.3%CVE-2024-3565MEDIUMContent Blocks (Custom Post Widget) <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via content_block ShortcodeEPSS 0.3%CVE-2024-6283MEDIUMDethemeKit For Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via URL Parameter of the De Gallery WidgetEPSS 0.3%CVE-2025-40648MEDIUMStored Cross-Site Scripting (XSS) vulnerability in Issabel productsEPSS 0.3%CVE-2025-20246MEDIUMA vulnerability in Cisco Webex could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. A vulnerabEPSS 0.3%CVE-2026-87091HIGHWelcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification ParametersEPSS 0.3%CVE-2024-5177MEDIUMHash Elements <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter in Multiple WidgetsEPSS 0.3%CVE-2024-9445MEDIUMDisplay Medium Posts <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_medium_posts ShortcodeEPSS 0.3%CVE-2024-37489MEDIUMWordPress Ocean Extra plugin <= 2.2.9 - Authenticated Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-63353CRITICALAffected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This EPSS 0.3%