Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-6301MEDIUMPHPGurukul Notice Board System Add Notice manage-notices.php cross site scriptingEPSS 0.3%CVE-2026-3347MEDIUMMulti Functional Flexi Lightbox <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via 'message' ParameterEPSS 0.3%CVE-2024-56036HIGHWordPress odPhotogallery plugin <= 0.5.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-2918MEDIUMUltimate Blocks – WordPress Blocks Plugin <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.3%CVE-2024-56033HIGHWordPress FAQs plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-56761MEDIUMMemos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does EPSS 0.3%CVE-2024-54209HIGHWordPress Awesome Shortcodes plugin <= 1.7.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-4544MEDIUMWavlink WL-WN578W2 POST Request login.cgi cross site scriptingEPSS 0.3%CVE-2025-60183MEDIUMWordPress Silencesoft RSS Reader Plugin <= 0.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-79315MEDIUMA reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-sidEPSS 0.3%CVE-2025-53941MEDIUMHollo renders posts received with form elements and allows submissionEPSS 0.3%CVE-2025-9429MEDIUMmtons mblog Post submit cross site scriptingEPSS 0.3%CVE-2025-13484MEDIUMCampcodes Complete Online Beauty Parlor Management System customer-list.php cross site scriptingEPSS 0.3%CVE-2025-11956HIGHXSS in Proliz's OBSEPSS 0.3%CVE-2025-70960MEDIUMA stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scrEPSS 0.3%CVE-2024-56030HIGHWordPress 10CentMail plugin <= 2.1.50 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-54208HIGHWordPress Block Controller plugin <= 1.4.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-45279MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP (CRM Blueprint Application Builder Panel)EPSS 0.3%CVE-2024-51591MEDIUMWordPress Slicko plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-30090HIGHmime.php in SquirrelMail through 1.4.23-svn-20250401 and 1.5.x through 1.5.2-svn-20250401 allows XSS via e-mail headers, because JavaScript EPSS 0.3%