Weaknesses of type CWE-79

30,301 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-40834MEDIUMA vulnerability has been identified in Mendix RichText (All versions >= V4.0.0 < V4.6.1). Affected widget does not properly neutralize the iEPSS 0.3%CVE-2025-0826HIGHStored Cross-site Scripting (XSS) vulnerability affecting 3D Navigate in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2026-44696MEDIUMOpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing overlays and data exfiltrationEPSS 0.3%CVE-2026-57326MEDIUMWordPress Business Directory plugin <= 6.4.22 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-6350MEDIUMWP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.32 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-56112MEDIUMCyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php.EPSS 0.3%CVE-2025-8719MEDIUMTranslate This - Google Translate Web Element Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via base_lang ParameterEPSS 0.3%CVE-2025-2078MEDIUMBlogBuzzTime-for-wp <= 1.1 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-12512MEDIUMAsk Me Anything (Anonymously) <= 1.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-39038MEDIUMBharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in GenerEPSS 0.3%CVE-2024-6178MEDIUMXSS vulnerability in LG SuperSign CMSEPSS 0.3%CVE-2024-47393MEDIUMWordPress Quill Forms plugin <= 3.7.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-43352MEDIUMWordPress GivingPress Lite theme <= 1.8.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-8308MEDIUMReflected XSS Polen Media's Website TemplateEPSS 0.3%CVE-2024-56020MEDIUMWordPress SvegliaT Buttons Plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-12251MEDIUMOpenWGA Admin UI cross site scriptingEPSS 0.3%CVE-2026-16640MEDIUMSearch API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082EPSS 0.3%CVE-2025-0600HIGHStored Cross-site Scripting (XSS) vulnerability affecting Product Explorer in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2026-2445MEDIUMReflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and ModificationEPSS 0.3%CVE-2026-114694HIGHWordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%