Weaknesses of type CWE-79

30,266 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-12524MEDIUMClinked Client Portal <= 1.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-3614MEDIUMElementsKit Elementor Addons and Templates <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom WidgetEPSS 0.3%CVE-2026-69235MEDIUMstored cross site scripting issue in Esri Portal for ArcGISEPSS 0.3%CVE-2024-47624HIGHWordPress BSK Forms Blacklist plugin <= 3.8.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-115821HIGHNewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' ParametersEPSS 0.3%CVE-2024-4993MEDIUMSQL injection vulnerability in SiAdminEPSS 0.3%CVE-2026-103389MEDIUMMISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation GraphEPSS 0.3%CVE-2024-28804HIGHAn issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. Stored Cross-site scripting (XSS) can occur via POST.EPSS 0.3%CVE-2025-3478HIGHOpenText Enterprise Security Manager Stored XSSEPSS 0.3%CVE-2019-25317MEDIUMKimai 2- persistent cross-site scripting (XSS)EPSS 0.3%CVE-2026-0691MEDIUMCM E-Mail Blacklist <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'black_email' ParameterEPSS 0.3%CVE-2026-66146MEDIUMMultiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote EPSS 0.3%CVE-2026-52475MEDIUMCross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.javEPSS 0.3%CVE-2024-6986MEDIUMCross-site Scripting (XSS) in parisneo/lollms-webuiEPSS 0.3%CVE-2026-103664MEDIUMMISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed ParameterEPSS 0.3%CVE-2025-22316MEDIUMWordPress WPBITS Addons For Elementor Page Builder plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-12448MEDIUMPosts and Products Views for WooCommerce <= 2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-22617MEDIUMWeGIA Cross-Site Scripting (XSS) Reflected endpoint 'editar_socio.php' parameter 'socio'EPSS 0.3%CVE-2025-5341MEDIUMForminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size ParametersEPSS 0.3%CVE-2024-0688MEDIUMWebSub (FKA. PubSubHubbub) <= 3.1.4 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%