Weaknesses of type CWE-79

30,300 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-14063MEDIUMSEO Links Interlinking <= 1.7.9.9.1 - Reflected Cross-Site Scripting via 'google_error' ParameterEPSS 0.3%CVE-2025-47489MEDIUMWordPress Beds24 Online Booking plugin <= 2.0.29 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-45754MEDIUMA stored cross-site scripting (XSS) vulnerability exists in SeedDMS 6.0.32. This vulnerability allows an attacker to inject malicious JavaScEPSS 0.3%CVE-2026-102786HIGHJoomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5EPSS 0.3%CVE-2025-46464MEDIUMWordPress Ads Pro plugin <= 5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2019-25323MEDIUMHeatmiser Netmonitor 3.03 - HTML InjectionEPSS 0.3%CVE-2023-1006LOWSourceCodester Medical Certificate Generator App New Record cross site scriptingEPSS 0.3%CVE-2025-44110MEDIUMFluxBB 1.5.11 is vulnerable to Cross Site Scripting (XSS) in via the Forum Description Field in admin_forums.php.EPSS 0.3%CVE-2025-31696MEDIUMRapiDoc OAS Field Formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-025EPSS 0.3%CVE-2025-12303MEDIUMPHPGurukul Curfew e-Pass Management System admin-profile.php cross site scriptingEPSS 0.3%CVE-2025-9044MEDIUMMapster WP Maps <= 1.20.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-85002MEDIUMEmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block AttributesEPSS 0.3%CVE-2026-49371HIGHIn JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possibleEPSS 0.3%CVE-2025-47499MEDIUMWordPress Simple Blog Stats plugin <= 20250416 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2019-25324MEDIUMRICOH Web Image Monitor 1.09 - HTML InjectionEPSS 0.3%CVE-2026-24744MEDIUMInvoicePlane has a Stored Cross-Site Scripting (XSS) issueEPSS 0.3%CVE-2025-52180MEDIUMCross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Infinity 4.2 and earlier allows remote unauthenticated attackers to inject arbiEPSS 0.3%CVE-2025-47504MEDIUMWordPress Custom Checkout Fields for WooCommerce plugin <= 1.8.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-46493MEDIUMWordPress Crossword Compiler Puzzles plugin <= 14.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-47442MEDIUMWordPress CC BMI Calculator plugin <= 2.1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%