Weaknesses of type CWE-79

30,300 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-52180MEDIUMCross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Infinity 4.2 and earlier allows remote unauthenticated attackers to inject arbiEPSS 0.3%CVE-2026-45270HIGHCI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation RuleEPSS 0.3%CVE-2026-49371HIGHIn JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possibleEPSS 0.3%CVE-2025-47505MEDIUMWordPress Product Time Countdown for WooCommerce plugin <= 1.6.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-47489MEDIUMWordPress Beds24 Online Booking plugin <= 2.0.29 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-9044MEDIUMMapster WP Maps <= 1.20.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-14063MEDIUMSEO Links Interlinking <= 1.7.9.9.1 - Reflected Cross-Site Scripting via 'google_error' ParameterEPSS 0.3%CVE-2026-102786HIGHJoomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5EPSS 0.3%CVE-2025-44110MEDIUMFluxBB 1.5.11 is vulnerable to Cross Site Scripting (XSS) in via the Forum Description Field in admin_forums.php.EPSS 0.3%CVE-2019-25323MEDIUMHeatmiser Netmonitor 3.03 - HTML InjectionEPSS 0.3%CVE-2025-46464MEDIUMWordPress Ads Pro plugin <= 5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-9131MEDIUMOgulo – 360° Tour <= 1.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via slug ParameterEPSS 0.3%CVE-2025-45754MEDIUMA stored cross-site scripting (XSS) vulnerability exists in SeedDMS 6.0.32. This vulnerability allows an attacker to inject malicious JavaScEPSS 0.3%CVE-2025-46518MEDIUMWordPress IGIT Related Posts With Thumb Image After Posts plugin <= 4.5.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-31687MEDIUMSpamSpan filter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-016EPSS 0.3%CVE-2025-56429MEDIUMCross Site Scripting vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to obtain sensitive information viEPSS 0.3%CVE-2025-31697MEDIUMFormatter Suite - Moderately critical - Cross site scripting - SA-CONTRIB-2025-026EPSS 0.3%CVE-2025-47616MEDIUMWordPress aBlocks plugin <= 1.9.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-47503MEDIUMWordPress NGG Smart Image Search plugin <= 3.3.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-51108MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in the component /admin/card-bwdates-report.php of PHPGURUKUL Medical Card GeneraEPSS 0.3%