Weaknesses of type CWE-79

30,296 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2019-25284MEDIUMV-SOL GPON/EPON OLT Platform V2.03.62R_IPv6 v2.03 Reflected Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2026-1986MEDIUMFloristPress for Woo <= 7.8.2 - Reflected Cross-Site Scripting via 'noresults' ParameterEPSS 0.3%CVE-2025-59983MEDIUMJunos Space: Template Definition page is vulnerable to reflected cross-site script injectionEPSS 0.3%CVE-2025-45878MEDIUMA cross-site scripting (XSS) vulnerability in the report manager function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary EPSS 0.3%CVE-2024-54775MEDIUMDcat-Admin v2.2.0-beta and v2.2.2-beta contains a Cross-Site Scripting (XSS) vulnerability via /admin/auth/menu and /admin/auth/extensions.EPSS 0.3%CVE-2024-13805MEDIUMAdvanced File Manager <= 5.2.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-27418MEDIUMWeGIA contains a Stored Cross-Site Scripting (XSS) in 'adicionar_tipo_atendido.php' via the 'tipo' parameterEPSS 0.3%CVE-2024-37523MEDIUMWordPress Login Logo Editor plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-26951MEDIUMWordPress C9 Blocks plugin <= 1.7.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-46453MEDIUMWordPress Zoho Creator Forms <= 1.0.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-4848MEDIUMdameng100 muucmf list.html cross site scriptingEPSS 0.3%CVE-2022-41789LOWPotential XSS on default page headerEPSS 0.3%CVE-2024-35751MEDIUMWordPress Woody code snippets plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-3894MEDIUMPhoto Gallery, Images, Slider in Rbs Image Gallery <= 3.2.19 - Authenticated (Author+) Stored Cross-Site Scripting via Image TitleEPSS 0.3%CVE-2025-57948MEDIUMWordPress Directory Pro Plugin <= 2.5.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2022-42001LOWPotential XSS in book navigationEPSS 0.3%CVE-2025-46483MEDIUMWordPress Peadig’s Google +1 Button plugin <= 0.1.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-67971HIGHWordPress FluentCart plugin < 1.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-10923HIGHImproper Neutralization vulnerability has been discovered in OpenText™ ALM Octane Management.EPSS 0.3%CVE-2025-0169MEDIUMDWT - Directory & Listing WordPress Theme <=3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%