Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-9590MEDIUMWeaver E-Mobile Mobile Management Platform cross site scriptingEPSS 0.3%CVE-2024-5739MEDIUMThe in-app browser of LINE client for iOS versions below 14.9.0 contains a Universal XSS (UXSS) vulnerability. This vulnerability allows forEPSS 0.3%CVE-2026-40534MEDIUMAn improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Synology DiskStation MEPSS 0.3%CVE-2012-20003MEDIUMCustom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.phpEPSS 0.3%CVE-2026-115982MEDIUMphpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scriptingEPSS 0.3%CVE-2025-13584MEDIUMEigenfocus Description cross site scriptingEPSS 0.3%CVE-2026-111877MEDIUMdext34-morgan Books4Cash search.php cross site scriptingEPSS 0.3%CVE-2025-49301MEDIUMWordPress Greenshift plugin <= 11.5.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-56263MEDIUMWordPress GS Shots for Dribbble plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-56241MEDIUMWordPress WPKoi Templates for Elementor plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-6159MEDIUMcode-projects Simple ChatBox Endpoint insert.php cross site scriptingEPSS 0.3%CVE-2019-25225MEDIUM`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does noEPSS 0.3%CVE-2025-49310MEDIUMWordPress Frontend Dashboard plugin <= 2.2.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-56258MEDIUMWordPress Magazine Blocks plugin <= 1.3.20 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-30951MEDIUMWordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.36 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-48239MEDIUMWordPress Product Notes Tab & Private Admin Notes for WooCommerce plugin <= 3.1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-49305MEDIUMWordPress Product Catalog Simple plugin <= 1.8.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-37344MEDIUMCross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06EPSS 0.3%CVE-2024-35146MEDIUMIBM Maximo Application Suite cross-site scriptingEPSS 0.3%CVE-2025-68864HIGHWordPress Infility Global plugin <= 2.15.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%