Weaknesses of type CWE-79

30,305 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-53989MEDIUMWordPress JetBlocks For Elementor plugin <= 1.3.19 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2023-53939MEDIUMTinyWebGallery v2.5 Stored Cross-Site Scripting via Folder Name ParameterEPSS 0.2%CVE-2025-43783MEDIUMReflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1EPSS 0.2%CVE-2026-7001MEDIUMDatacom DM4100 Ethernet Configuration cross site scriptingEPSS 0.2%CVE-2025-42948MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP PlatformEPSS 0.2%CVE-2026-28772MEDIUMReflected XSS in IDC_Logging Index endpointEPSS 0.2%CVE-2021-35483MEDIUMThe Applications component of Nokia IMPACT version through 19.11.2.10-20210118042150283 allows an authenticated user to arbitrarily upload JEPSS 0.2%CVE-2026-6995MEDIUMBDCOM P3310D New User index.asp cross site scriptingEPSS 0.2%CVE-2026-6549MEDIUMLogo Manager For Enamad <= 0.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode AttributeEPSS 0.2%CVE-2025-7498MEDIUMExclusive Addons for Elementor <= 2.7.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via CountdownEPSS 0.2%CVE-2026-5109HIGHGravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product OptionEPSS 0.2%CVE-2025-53994MEDIUMWordPress JetPopup plugin <= 2.0.15 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-109633HIGHFrappe ERPNext before 15.119.1 Stored XSS via Public Booking PageEPSS 0.2%CVE-2025-42942MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAPEPSS 0.2%CVE-2025-29526MEDIUMA Cross-Site Scripting (XSS) vulnerability in the search function of Q4 Inc Investor Relations Platform v5.147.1.2 allows attackers to execuEPSS 0.2%CVE-2025-4170MEDIUMXavin's Review Ratings <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-6998MEDIUMBDCOM P3310D New RMON Statistics cross site scriptingEPSS 0.2%CVE-2025-53984MEDIUMWordPress JetTabs plugin <= 2.2.9 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2023-53897MEDIUMRukovoditel 3.4.1 Multiple Stored Cross-Site Scripting via CommentsEPSS 0.2%CVE-2025-53995MEDIUMWordPress JetPopup plugin <= 2.0.15.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%