Weaknesses of type CWE-79

30,271 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-39662MEDIUMWordPress Black Widgets For Elementor plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-55464MEDIUMSnipe-IT: Stored XSS via Markdown custom fieldEPSS 0.3%CVE-2024-44794MEDIUMA cross-site scripting (XSS) vulnerability in the component /master/auth/OnedriveRedirect.php of PicUploader commit fcf82ea allows attackersEPSS 0.3%CVE-2025-24892LOWOpenProject stored HTML injection vulnerabilityEPSS 0.3%CVE-2025-11437MEDIUMJhumanJ OpnForm Form Editor forms cross site scriptingEPSS 0.3%CVE-2026-23840CRITICALMovary vulnerable to Cross-site Scripting with `?categoryDeleted=` paramEPSS 0.3%CVE-2024-43936MEDIUMWordPress EmbedPress plugin <= 4.0.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-39649MEDIUMWordPress Essential Addons for Elementor plugin <= 5.9.26 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-39400HIGHWordPress User Registration plugin < 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-53774MEDIUMWordPress Sparkle Elementor Kit plugin <= 2.0.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-0820MEDIUMClicface Trombi <= 2.08 - Authenticated (Contributor+) Stored Cross-Site Scripting via nom ParameterEPSS 0.3%CVE-2026-42615HIGHGCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show_Base64_offsets('%3Cscript substring.EPSS 0.3%CVE-2024-53758MEDIUMWordPress WP MathJax plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-7654HIGHUnauthenticated Content Injection in OpenEdge Management web interface via ActiveMQ discovery serviceEPSS 0.3%CVE-2025-8092HIGHCOOKiES Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-092EPSS 0.3%CVE-2024-41705HIGHA stored XSS issue was discovered in Archer Platform 6.8 before 2024.06. A remote authenticated malicious Archer user could potentially explEPSS 0.3%CVE-2023-45227MEDIUMWestermo Lynx Cross-site ScriptingEPSS 0.3%CVE-2025-62597MEDIUMWeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'sql'EPSS 0.3%CVE-2024-48662MEDIUMCross Site Scripting vulnerability in AdGuard Application v.7.18.1 (4778) and before allows an attacker to execute arbitrary code via a crafEPSS 0.3%CVE-2024-20256MEDIUMA vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Web AppliaEPSS 0.3%