Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-39509MEDIUMWordPress TNC FlipBook plugin <= 12.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-78318MEDIUMApache Syncope: Unauthenticated reflected XSS in Console and EnduserEPSS 0.3%CVE-2026-27016MEDIUMLibreNMS has Stored XSS in Custom OID - unit parameter missing strip_tags()EPSS 0.3%CVE-2024-37239MEDIUMWordPress Branda plugin <= 3.4.17 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5173MEDIUMHT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget SettingsEPSS 0.3%CVE-2026-9419MEDIUMcode-projects Employee Management System empproject.php cross site scriptingEPSS 0.3%CVE-2026-52370MEDIUMA reflected cross-site scripting (XSS) vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary JavascrEPSS 0.3%CVE-2024-58391MEDIUMFrappe before 15.4.0 XSS via Printview ParametersEPSS 0.3%CVE-2026-91944MEDIUMcrawl4ai before 0.9.3 DOM-based XSS via Playground UIEPSS 0.3%CVE-2026-82788MEDIUMCross-site scripting vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an arbitrary script may be executed on a loggeEPSS 0.3%CVE-2025-31543MEDIUMWordPress Twice Commerce plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31593MEDIUMWordPress OpenMenu plugin <= 3.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31532MEDIUMWordPress AtomChat plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-88743MEDIUMBacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags.EPSS 0.3%CVE-2026-85599MEDIUMGrav Shortcode Core before 6.2.5 Stored XSS via unescaped parametersEPSS 0.3%CVE-2026-120343MEDIUMmathurvishal CloudClassroom-PHP-Project manageassessment2.php cross site scriptingEPSS 0.3%CVE-2021-27703MEDIUMSercomm Model Etisalat Model S3- AC2100 is affected by Cross Site Scripting (XSS) via the firmware update page.EPSS 0.3%CVE-2026-6150MEDIUMcode-projects Simple Laundry System checkupdatestatus.php cross site scriptingEPSS 0.3%CVE-2024-8543MEDIUMSlider comparison image before and after <= 0.8.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-4001MEDIUMDownload Manager <= 3.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form ShortcodeEPSS 0.3%