Weaknesses of type CWE-79

30,259 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-13548MEDIUMPower Ups for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-23523HIGHWordPress HSS Embed Streaming Video plugin <= 3.23 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-13849MEDIUMCookie Notice Bar <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-41876MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.3%CVE-2025-13604HIGHLogin Security, FireWall, Malware removal by CleanTalk <= 2.168 - Unauthenticated Stored Cross-Site Scripting via Page URLEPSS 0.3%CVE-2025-2488MEDIUMXSS in Profelis Informatics' SambaBoxEPSS 0.3%CVE-2024-35734HIGHWordPress WP Time Slots Booking Form plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-32852MEDIUMMailEnable < 10.55 Reflected XSS via FreeBusy.aspx StartDate ParameterEPSS 0.3%CVE-2024-27794MEDIUMClaris FileMaker Server before version 20.3.2 was susceptible to a reflected Cross-Site Scripting vulnerability due to an improperly handledEPSS 0.3%CVE-2023-6987MEDIUMString Locator <= 2.6.5 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2021-38134MEDIUMPossible Reflected and Stored XSS in OpenText iManagerEPSS 0.3%CVE-2025-23599HIGHWordPress eMarksheet plugin <= 5.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-11854MEDIUMListdom – Business Directory and Classified Ads Listings WordPress Plugin <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode ParameterEPSS 0.3%CVE-2024-39652HIGHWordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-2245MEDIUMCross-Site Scripting vulnerability in moziloCMSEPSS 0.3%CVE-2025-51624HIGHCross-site scripting (XSS) vulnerability in Zone Bitaqati thru 3.4.0.EPSS 0.3%CVE-2025-23685HIGHWordPress RomanCart On WordPress plugin <= 0.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-33987HIGHCross-Site Scripting (XSS) vulnerability in Janobe productsEPSS 0.3%CVE-2024-41848MEDIUMAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.3%CVE-2024-37262HIGHWordPress Online Booking & Scheduling Calendar plugin <= 4.4.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%