Weaknesses of type CWE-79

30,284 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-13734MEDIUMCard Elements for Elementor <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Profile Card WidgetEPSS 0.3%CVE-2025-61312HIGHA reflected cross-site scripted (XSS) vulnerability in the acc-menu_pricess.php component of GmbH Mecury Managed Print Services (docuForm) vEPSS 0.3%CVE-2026-23630MEDIUMDocmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid renderingEPSS 0.3%CVE-2022-36417MEDIUMWordPress 3D Tag Cloud plugin <= 3.8 - Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerabilityEPSS 0.3%CVE-2023-52069MEDIUMkodbox v1.49.04 was discovered to contain a cross-site scripting (XSS) vulnerability via the URL parameter.EPSS 0.3%CVE-2023-6672MEDIUMStored XSS in National Keep's CyberMathEPSS 0.3%CVE-2025-1689MEDIUMThemeMakers PayPal Express Checkout <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2025-4405MEDIUMHot Random Image <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via link ParameterEPSS 0.3%CVE-2026-109960HIGHFroxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme ValueEPSS 0.3%CVE-2026-100196HIGHLazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.3%CVE-2024-51664MEDIUMWordPress Beds24 Online Booking plugin <= 2.0.25 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-23169MEDIUMThe web interface in RSA NetWitness 11.7.2.0 allows Cross-Site Scripting (XSS) via the Where textbox on the Reports screen during new rule cEPSS 0.3%CVE-2024-31160MEDIUMASUS Download Master - Stored XSSEPSS 0.3%CVE-2024-37521MEDIUMWordPress zBench theme <= 1.4.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-109288HIGHOpen WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown LinksEPSS 0.3%CVE-2026-30830LOWDefuddle: XSS via unescaped string interpolation in _findContentBySchemaText image tagEPSS 0.3%CVE-2024-46077MEDIUMitsourcecode Online Tours and Travels Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the val-usEPSS 0.3%CVE-2026-0742MEDIUMSmart Appointment & Booking <= 1.0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via saab_save_form_data AJAX ActionEPSS 0.3%CVE-2025-50859MEDIUMReflected Cross-Site Scripting in the Change Template function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackersEPSS 0.3%CVE-2025-7791MEDIUMPHPGurukul Online Security Guards Hiring System search.php cross site scriptingEPSS 0.3%