Weaknesses of type CWE-79

30,304 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-13988MEDIUM评论小秘书 <= 1.3.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']EPSS 0.2%CVE-2025-13895MEDIUMTop Position Google Finance <= 0.1.0 - Reflected Cross-Site ScriptingEPSS 0.2%CVE-2026-24855HIGHChurchCRM has Stored Cross-Site Scripting (XSS) in Create Events in Church Calendar, Leading to Account TakeoverEPSS 0.2%CVE-2024-31908MEDIUMIBM Planning Analytics Local cross-site scriptingEPSS 0.2%CVE-2025-49062HIGHWordPress WP-jScrollPane plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-48398MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2024-44120MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise PortalEPSS 0.2%CVE-2025-12077MEDIUMWP to LinkedIn Auto Publish <= 1.9.8 - Reflected Cross-Site Scripting via PostMessageEPSS 0.2%CVE-2024-51605MEDIUMWordPress Genoo plugin <= 6.0.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-46367HIGHphpMyFAQ - Stored XSS via Utils::parseUrl() in Comment RenderingEPSS 0.2%CVE-2025-49065HIGHWordPress Visit Counter Plugin <= 1.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-55200HIGHBigBlueButton vulnerable to Stored XSS via name of user at Shared NotesEPSS 0.2%CVE-2025-13512MEDIUMCoSign Single Signon <= 0.3.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']EPSS 0.2%CVE-2024-52423MEDIUMWordPress Themify Builder plugin <= 7.6.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-104473MEDIUMYesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpagesEPSS 0.2%CVE-2025-11820MEDIUMGraphina – Elementor Charts and Graphs <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart WidgetsEPSS 0.2%CVE-2025-3733MEDIUMbaguetteBox.js - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-034EPSS 0.2%CVE-2024-39457MEDIUMCybozu Garoon 6.0.0 to 6.0.1 contains a cross-site scripting vulnerability in PDF preview. If this vulnerability is exploited, an arbitrary EPSS 0.2%CVE-2025-53296MEDIUMWordPress EC Stars Rating plugin <= 1.0.11 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-31382MEDIUMGainsight Assist reflected XSS/HTML injectionEPSS 0.2%