Weaknesses of type CWE-79

30,293 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-22876MEDIUMStrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case attachment functionality which EPSS 0.3%CVE-2026-61607MEDIUMGrav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses SanitizerEPSS 0.3%CVE-2024-32572MEDIUMWordPress Element Pack Elementor Addons plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66029MEDIUMEkushey Project Manager CRM 5.0 Stored XSS via Client Name FieldEPSS 0.3%CVE-2026-66030MEDIUMEkushey Project Manager CRM 5.0 Stored XSS via Ticket Title FieldEPSS 0.3%CVE-2024-29920MEDIUMWordPress Move Addons for Elementor plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-48366MEDIUMGroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized ActionsEPSS 0.3%CVE-2024-13289MEDIUMCookiebot + GTM - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-055EPSS 0.3%CVE-2025-65237MEDIUMA reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary JavEPSS 0.3%CVE-2024-32557MEDIUMWordPress Exclusive Addons for Elementor plugin <= 2.6.9.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-24751HIGHKiteworks Secure Data Forms Vulnerable to Cross-site ScriptingEPSS 0.3%CVE-2026-73537MEDIUMCross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed inEPSS 0.3%CVE-2024-25702MEDIUMBUG-000160599 - Stored XSS in Portal for ArcGIS Web App BuilderEPSS 0.3%CVE-2024-20487MEDIUMCisco Identity Services Engine Stored Cross-Site Scripting VulnerabiliyEPSS 0.3%CVE-2024-49377MEDIUMJinja2 Templates are vulnerable to XSS attacks due to their configuration in OctoPrintEPSS 0.3%CVE-2024-20443MEDIUMA vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack agEPSS 0.3%CVE-2024-42816MEDIUMA cross-site scripting (XSS) vulnerability in the Create Product function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary EPSS 0.3%CVE-2026-55491MEDIUMBigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting NameEPSS 0.3%CVE-2024-22877MEDIUMStrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case reporting functionality. This feature allows an atEPSS 0.3%CVE-2024-20257MEDIUMA vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an authenticated,EPSS 0.3%