Weaknesses of type CWE-79

30,300 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-14137MEDIUMSimple AL Slider <= 1.2.10 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']EPSS 0.3%CVE-2025-13624MEDIUMOverstock Affiliate Links <= 1.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']EPSS 0.3%CVE-2024-3066MEDIUMElegant Addons for elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML tagsEPSS 0.3%CVE-2024-9198HIGHStored Cross-Site Scripting vulnerability in Clibo ManagerEPSS 0.3%CVE-2025-26877MEDIUMWordPress Front End Users Plugin <= 3.2.30 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-9872MEDIUMOnline Booking & Scheduling Calendar for WordPress by vcita <= 4.5.1 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-5714MEDIUMEnable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' ParameterEPSS 0.3%CVE-2026-27901MEDIUMSvelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`EPSS 0.3%CVE-2025-13623MEDIUMTwitscription <= 0.1.1 - Reflected Cross-Site Scripting via admin.php PATH_INFOEPSS 0.3%CVE-2024-41911MEDIUMA vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The flaw does not properly neutralizeEPSS 0.3%CVE-2024-2772MEDIUMContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-5966MEDIUMGrey Opaque <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Download-Button ShortcodeEPSS 0.3%CVE-2026-27116MEDIUMVikunja has Reflected HTML Injection via filter Parameter in Projects ModuleEPSS 0.3%CVE-2025-31416HIGHWordPress Awesome Event Booking plugin <= 2.8.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-20307MEDIUMCisco BroadWorks Application Delivery Platform Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2025-31389HIGHWordPress Sequel plugin <= 1.0.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-1749MEDIUMHTML injection vulnerability in OpenCartEPSS 0.3%CVE-2025-53575HIGHWordPress Primer MyData for Woocommerce Plugin <= 4.2.5 - Cross Site Request Forgery (CSRF) VulnerabilityEPSS 0.3%CVE-2025-13622MEDIUMJabbernotification <= 0.99-RC2 - Reflected Cross-Site Scripting via admin.php PATH_INFOEPSS 0.3%CVE-2025-6815MEDIUMLatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%