Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-6488MEDIUMisMobile <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via device ParameterEPSS 0.3%CVE-2024-56301HIGHWordPress Distance Based Shipping Calculator Plugin <= 2.0.21 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-20076MEDIUMCisco Identity Services Engine Stored Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2025-27305MEDIUMWordPress Table of Contents Block plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-0739MEDIUMWMF Mobile Redirector <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings ParametersEPSS 0.3%CVE-2025-13960MEDIUMGPXpress <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2026-41576HIGHAjax30/BraveCMS-2.0: Stored HTML Injection in Contact Email via nl2br() and Unescaped Blade TemplateEPSS 0.3%CVE-2025-13889MEDIUMSimple Nivo Slider <= 0.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2024-39311LOWPublify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User InteractionEPSS 0.3%CVE-2024-43975HIGHWordPress Super Store Finder plugin <= 6.9.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-48486MEDIUMFreeScout Vulnerable to Stored XSSEPSS 0.3%CVE-2025-47086MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2024-53283MEDIUMImproper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Router Port Forward functionality in SEPSS 0.3%CVE-2024-43958HIGHWordPress Into The Dark theme <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-44003HIGHWordPress Spice Starter Sites plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-50430MEDIUMWordPress Beaver Builder plugin <= 2.8.3.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-13377MEDIUMWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in SIP Proxy ConfigurationEPSS 0.3%CVE-2024-6380HIGHReflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2024-48068MEDIUMA cross-site scripting (XSS) vulnerability in Shenzhen Landray Software Co.,LTD Landray EKP v16 and earlier allows attackers to execute arbiEPSS 0.3%CVE-2025-48487MEDIUMFreeScout Vulnerable to Stored XSSEPSS 0.3%