Weaknesses of type CWE-79

30,256 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-11886MEDIUMContact Form and Calls To Action by vcita <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-30442MEDIUMWordPress Bold Page Builder plugin <= 4.8.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-54232MEDIUMWordPress RRAddons for Elementor plugin <= 1.1.0 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-34564CRITICALCI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSSEPSS 0.3%CVE-2024-11321MEDIUMReflected XSS in Hi e-learning's Learning Management System (LMS)EPSS 0.3%CVE-2024-33916MEDIUMWordPress CPO Companion plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-33926MEDIUMWordPress GWP-Histats plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-38308HIGHAdvantech ADAM-5550 Cross-site ScriptingEPSS 0.3%CVE-2024-32526MEDIUMWordPress Easy Textillate plugin <= 2.02 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-13561MEDIUMTarget Video Easy Publish <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via brid_override_yt ShortcodeEPSS 0.3%CVE-2024-32554MEDIUMWordPress Knight Lab Timeline plugin <= 3.9.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-63611HIGHCross-Site Scripting in phpgurukul Hostel Management System v2.1 user-provided complaint fields (Explain the Complaint) submitted via /regisEPSS 0.3%CVE-2024-9141MEDIUMCross-Site Scripting (XSS) vulnerability in Oct8neEPSS 0.3%CVE-2024-56287MEDIUMWordPress WP jQuery DataTable Plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-1026LOWCogites eReserv config.php cross site scriptingEPSS 0.3%CVE-2025-2542MEDIUMYour Simple SVG Support <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-26159MEDIUMLaravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature. Any user with the ability of create or modify tags EPSS 0.3%CVE-2023-6990MEDIUMWeaver Xtreme <= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-4000MEDIUMSeeyon Zhiyuan OA Web Application System ssoproxy.jsp cross site scriptingEPSS 0.3%CVE-2025-3999MEDIUMSeeyon Zhiyuan OA Web Application System URL Parameter date.jsp cross site scriptingEPSS 0.3%