Weaknesses of type CWE-79

30,293 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-4026MEDIUMCross-Site Scripting in the Holded applicationEPSS 0.3%CVE-2026-66029MEDIUMEkushey Project Manager CRM 5.0 Stored XSS via Client Name FieldEPSS 0.3%CVE-2025-70515MEDIUMThe device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The laEPSS 0.3%CVE-2025-41085MEDIUMStored Cross-Site Scripting (XSS) in Apidog web platformEPSS 0.3%CVE-2026-97030MEDIUMRecognize yield as regexp preceder keyword in html/templateEPSS 0.3%CVE-2025-48366MEDIUMGroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized ActionsEPSS 0.3%CVE-2025-8337MEDIUMcode-projects Simple Car Rental System add_vehicles.php cross site scriptingEPSS 0.3%CVE-2024-56265HIGHWordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32572MEDIUMWordPress Element Pack Elementor Addons plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-5539MEDIUMcode-projects Simple Laundry System Parameter modifymember.php cross site scriptingEPSS 0.3%CVE-2024-32576MEDIUMWordPress BA Book Everything plugin <= 1.6.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-63420MEDIUMCrushFTP11 before 11.3.7_57 is vulnerable to stored HTML injection in the CrushFTP Admin Panel (Reports / "Who Created Folder"), enabling peEPSS 0.3%CVE-2024-22876MEDIUMStrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case attachment functionality which EPSS 0.3%CVE-2024-39125MEDIUMRoundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.EPSS 0.3%CVE-2024-36238MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.3%CVE-2023-42427MEDIUMCross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.7, which may allow a remote authenticated attacker EPSS 0.3%CVE-2023-52045MEDIUMStudio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting (XSS) vulnerability.EPSS 0.3%CVE-2026-1316HIGHCustomer Reviews for WooCommerce <= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media[].href ParameterEPSS 0.3%CVE-2026-100148MEDIUMRich Showcase for Google Reviews <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Google Review Text (imported via Places API)EPSS 0.3%CVE-2025-41065MEDIUMStored Cross-Site Scripting (XSS) in LUNA from Luna ImagingEPSS 0.3%