Weaknesses of type CWE-79

30,306 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-4172MEDIUMVerticalResponse Newsletter Widget <= 1.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-13220MEDIUMUltimate Member <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2025-4131MEDIUMGmapsMania <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%CVE-2026-0505MEDIUMMultiple vulnerabilities in BSP Applications of SAP Document Management SystemEPSS 0.2%CVE-2025-9496MEDIUMEnable Media Replace <= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified ShortcodeEPSS 0.2%CVE-2025-8440MEDIUMTeam Members <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-9442MEDIUMStreamWeasels Kick Integration <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via vodsChannel ParameterEPSS 0.2%CVE-2026-48949MEDIUMJoomla! Core - [20260703] - XSS in MFA method managementEPSS 0.2%CVE-2026-48953MEDIUMJoomla! Core - [20260707] - XSS in the generic image output layoutEPSS 0.2%CVE-2026-1908MEDIUMIntegration with Hubspot Forms <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-21943MEDIUMVulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Scripting Admin). Supported versions that are affectedEPSS 0.2%CVE-2025-0419MEDIUMXSS in Mikrogrup's Zirve NovaEPSS 0.2%CVE-2025-26653MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)EPSS 0.2%CVE-2025-22732MEDIUMWordPress Ad Blocking Detector plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-39344HIGHReflected XSS the login page through the 'username' parameterEPSS 0.2%CVE-2026-21951MEDIUMVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). Supported versions thaEPSS 0.2%CVE-2025-22727MEDIUMWordPress MailChimp Subscribe Form plugin <= 4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-56736HIGHphpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ SubmissionEPSS 0.2%CVE-2026-107870HIGHWordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-8394MEDIUMProductive Style <= 1.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_productive_breadcrumb ShortcodeEPSS 0.2%