Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-67849HIGHMoodle: moodle: cross-site scripting (xss) via improper sanitization of ai prompt responsesEPSS 0.3%CVE-2026-1796MEDIUMStyleBidet <= 1.0.0 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-50848MEDIUMA file upload vulnerability was discovered in CS Cart 4.18.3, allows attackers to execute arbitrary code. CS Cart 4.18.3 allows unrestrictedEPSS 0.3%CVE-2026-27009MEDIUMOpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injectionEPSS 0.3%CVE-2025-8196MEDIUMMagical Addons For Elementor <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom AttributesEPSS 0.3%CVE-2026-4379MEDIUMLightPress Lightbox <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group' Shortcode AttributeEPSS 0.3%CVE-2025-8391MEDIUMMagic Edge – Lite <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via height ParameterEPSS 0.3%CVE-2025-48918HIGHSimple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-071EPSS 0.3%CVE-2024-21188MEDIUMVulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: EPSS 0.3%CVE-2025-7658MEDIUMTemporarily Hidden Content <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-63949MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allows a remote attacker to executEPSS 0.3%CVE-2025-53253MEDIUMWordPress WP Edit plugin <= 4.0.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2023-53928MEDIUMPHPFusion 9.10.30 Stored Cross-Site Scripting via File Manager UploadEPSS 0.3%CVE-2025-66924MEDIUMA Cross-site scripting (XSS) vulnerability in Create/Update Item Kit(s) in Open Source Point of Sale v3.4.1 allows remote attackers to injecEPSS 0.3%CVE-2026-3513MEDIUMTableOn – WordPress Posts Table Filterable <= 1.0.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode AttributeEPSS 0.3%CVE-2025-7809MEDIUMStreamWeasels Twitch Integration <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-6673MEDIUMEasy restaurant menu manager <= 2.0.1 - Authenticated (Contributot+) Stored Cross-Site Scripting via `nsc_eprm_menu_link` ShortcodeEPSS 0.3%CVE-2025-9225MEDIUMCross-site scripting (XSS) in MiR robots and MiR fleetEPSS 0.3%CVE-2024-45594HIGHDecidim allows cross-site scripting (XSS) in the online or hybrid meeting embedsEPSS 0.3%CVE-2025-8212MEDIUMMedical Addon for Elementor <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter WidgetEPSS 0.3%