Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-7845MEDIUMStratum – Elementor Widgets <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Google Maps and Image Hotspot WidgetsEPSS 0.3%CVE-2026-55808MEDIUMDrupal core - Moderately critical - Improper validation - SA-CORE-2026-009EPSS 0.3%CVE-2026-104612MEDIUMSourceCodester Student Result Management System Announcement new_announcement.php cross site scriptingEPSS 0.3%CVE-2026-105708MEDIUMimgproxy SVG svg.go sanitizeElement cross site scriptingEPSS 0.3%CVE-2026-4495MEDIUMatjiu pybbs CommentApiController.java create cross site scriptingEPSS 0.3%CVE-2025-62421MEDIUMDataEase vulnerable to stored cross-site scripting via file upload bypassEPSS 0.3%CVE-2025-57424HIGHA stored cross-site scripting (XSS) vulnerability exists in the MyCourts v3 application within the LTA number profile field. An attacker canEPSS 0.3%CVE-2026-81925LOWConcrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date FormatEPSS 0.3%CVE-2026-2939MEDIUMitsourcecode Student Management System Add Student add_student cross site scriptingEPSS 0.3%CVE-2026-112093MEDIUMsubhajitkhan online-clinic-management-system feedback.php cross site scriptingEPSS 0.3%CVE-2024-52702MEDIUMA stored cross-site scripting (XSS) vulnerability in the component install\index.php of MyBB v1.8.38 allows attackers to execute arbitrary wEPSS 0.3%CVE-2025-14142MEDIUMElectric Enquiries <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Shortcode AttributeEPSS 0.3%CVE-2026-115536MEDIUMgedelumbung HospitalManagement Admin Routing routing_pages.php simpan cross site scriptingEPSS 0.3%CVE-2024-11990MEDIUMCross-Site Scripting (XSS) en SurgeMail de NetWinEPSS 0.3%CVE-2024-9272MEDIUMR Animated Icon Plugin <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2026-97650MEDIUMningzichun student-management-system addLog.php echo cross site scriptingEPSS 0.3%CVE-2025-41003MEDIUMMultiple vulnerabilities in Imaster products Open configuration optionsEPSS 0.3%CVE-2024-4812MEDIUMKatello: potential cross-site scripting exploit in uiEPSS 0.3%CVE-2026-11512MEDIUMitsourcecode Hospital Management System billing.php cross site scriptingEPSS 0.3%CVE-2026-10810MEDIUMitsourcecode Fees Management System navbar.php cross site scriptingEPSS 0.3%