Weaknesses of type CWE-79

30,305 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-32800MEDIUMWordPress Popup – Popup More Popups plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-34769MEDIUMWordPress Elegant Blocks – Amazing Gutenberg Blocks plugin <= 1.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-47201MEDIUMIn Intrexx Portal Server before 12.0.4, multiple Velocity-Scripts are susceptible to the execution of unrequested JavaScript code in HTML, aEPSS 0.2%CVE-2026-9485MEDIUMSourceCodester Student Grades Management System students.php cross site scriptingEPSS 0.2%CVE-2025-42969MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP PlatformEPSS 0.2%CVE-2025-4171MEDIUMWZ Followed Posts – Display what visitors are reading <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-9471MEDIUMyashpokharna2555 StudentManagementSystem student.php cross site scriptingEPSS 0.2%CVE-2026-5717MEDIUMVI: Include Post By <= 0.4.200706 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_container' Shortcode AttributeEPSS 0.2%CVE-2025-32999MEDIUMCross-site scripting vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and prior to Ver. 3.0.47. This issue exists in a speciEPSS 0.2%CVE-2026-94402MEDIUMIBM vulnerable to cross-site scripting (XSS) via unsanitized title truncationEPSS 0.2%CVE-2025-8116MEDIUMReflected XSS in PAD CMSEPSS 0.2%CVE-2026-0800HIGHUser Submitted Posts – Enable Users to Submit Posts from the Front End <= 20251210 - Unauthenticated Stored Cross-Site Scripting via Custom FieldEPSS 0.2%CVE-2026-5254MEDIUMwelovemedia FFmate Webhook AppJsonTreeView.vue cross site scriptingEPSS 0.2%CVE-2026-2545MEDIUMLigeroSmart index.pl cross site scriptingEPSS 0.2%CVE-2025-22680HIGHWordPress Ad Inserter Pro plugin <= 2.7.39 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-12570HIGHFancy Product Designer <= 6.4.8 - Unauthenticated Stored Cross-Site Scripting via SVG File UploadEPSS 0.2%CVE-2026-0642MEDIUMprojectworlds House Rental and Property Listing complaint.php cross site scriptingEPSS 0.2%CVE-2025-9876MEDIUMIrd Slider <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-27442MEDIUMZoom Workplace Apps - Cross Site ScriptingEPSS 0.2%CVE-2017-20219MEDIUMServiio PRO 1.8 DOM-based Cross-Site Scripting via mediabrowserEPSS 0.2%