Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-51963MEDIUMStored XSS in ArcGIS Server ManagerEPSS 0.3%CVE-2025-66939MEDIUMCross Site Scripting vulnerability in 66biolinks by AltumCode v.61.0.1 allows an attacker to execute arbitrary code via a crafted favicon fiEPSS 0.3%CVE-2025-23894HIGHWordPress wp-flickr-press Plugin <= 2.6.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-6725MEDIUMCross-Site Scripting (XSS) in PdfViewerEPSS 0.3%CVE-2025-22357HIGHWordPress Target Notifications plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-92225MEDIUMJoomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3EPSS 0.3%CVE-2024-51959MEDIUMStored XSS issue in Server Admin APIEPSS 0.3%CVE-2025-46475MEDIUMWordPress Able Player plugin <= 1.2.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-7716MEDIUMReal-time SEO for Drupal - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-091EPSS 0.3%CVE-2024-12020MEDIUMReflected Cross-Site Scripting (XSS)EPSS 0.3%CVE-2025-63830MEDIUMCKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function. An attacker can upload a crafted SVG containing actiEPSS 0.3%CVE-2026-8624MEDIUMLJ comments import: reloaded <= 0.97.1 - Reflected Cross-Site Scripting via PHP_SELF ParameterEPSS 0.3%CVE-2025-65790MEDIUMA reflected cross-site scripting (XSS) vulnerability exists in FuguHub 8.1 when serving SVG files through the /fs/ file manager interface. FEPSS 0.3%CVE-2025-23729HIGHWordPress XTRA Settings plugin <= 2.1.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-12471MEDIUMHubbub Lite <= 1.36.0 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-29322MEDIUMA cross-site scripting (XSS) vulnerability in ScriptCase before v1.0.003 - Build 3 allows attackers to execute arbitrary code via a crafted EPSS 0.3%CVE-2024-37173MEDIUM[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)EPSS 0.3%CVE-2025-23540HIGHWordPress WP Front-end login and register plugin <= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-23636HIGHWordPress My Favorite Car plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22733HIGHWordPress My auctions allegro Plugin <= 3.6.18 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%