Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-5742MEDIUMCWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated userEPSS 0.3%CVE-2025-9499MEDIUMOcean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library ShortcodeEPSS 0.3%CVE-2025-7811MEDIUMStreamWeasels YouTube Integration <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-64747MEDIUMDirectus Vulnerable to Stored Cross-site ScriptingEPSS 0.3%CVE-2025-5703MEDIUMStageShow <= 10.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor ParameterEPSS 0.3%CVE-2025-43760MEDIUMA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.QEPSS 0.3%CVE-2026-108725MEDIUMCheshire Cat AI core through 2.0.23 Stored XSS via uploads pluginEPSS 0.3%CVE-2025-29389MEDIUMPbootCMS v3.2.9 contains a XSS vulnerability in admin.php?p=/Content/index/mcode/2#tab=t2.EPSS 0.3%CVE-2018-25249MEDIUMMyBB My Arcade Plugin 1.3 Persistent XSS via CommentEPSS 0.3%CVE-2026-27963MEDIUMAudiobookshelf has Stored XSS in Tooltip.vue via Audiobook MetadataEPSS 0.3%CVE-2026-79718MEDIUMReflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perEPSS 0.3%CVE-2026-5428MEDIUMRoyal Addons for Elementor <= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption FieldEPSS 0.3%CVE-2021-20553MEDIUMIBM Sterling B2B Integrator Standard Edition cross-site scriptingEPSS 0.3%CVE-2025-7367MEDIUMStrong Testimonials <= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom FieldsEPSS 0.3%CVE-2026-121652MEDIUMStored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup renderingEPSS 0.3%CVE-2026-79719MEDIUMReflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perEPSS 0.3%CVE-2026-4175MEDIUMAureus ERP Chatter Message content-text-entry.blade.php cross site scriptingEPSS 0.3%CVE-2025-7655MEDIUMLive Stream Badger <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-41753MEDIUMIBM Cloud Pak for Business Automation cross-site scriptingEPSS 0.3%CVE-2026-1792MEDIUMGeo Widet <= 1.0 - Reflected Cross-Site ScriptingEPSS 0.3%