Weaknesses of type CWE-79

30,317 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-49412MEDIUMWordPress Page Transition plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-39390MEDIUMCI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe settingEPSS 0.2%CVE-2025-11922MEDIUMInactive Logout <= 3.5.5 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-22763HIGHWordPress Brizy Pro Plugin <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-13283MEDIUMFacets - Critical - Cross Site Scripting - SA-CONTRIB-2024-047EPSS 0.2%CVE-2025-33008MEDIUMIBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site scriptingEPSS 0.2%CVE-2025-36436MEDIUMMultiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for January 2026.EPSS 0.2%CVE-2023-42247MEDIUMSelesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s_monitor_map.php.EPSS 0.2%CVE-2026-22520HIGHWordPress Handmade Framework plugin <= 3.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-15174MEDIUMSohuTV CacheCloud AppManageController.java doAppAuditList cross site scriptingEPSS 0.2%CVE-2025-43734MEDIUMA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.QEPSS 0.2%CVE-2025-48377MEDIUMDnn.Platform vulnerable to Reflected Cross-Site Scripting (XSS) in module actions in edit modeEPSS 0.2%CVE-2026-105987MEDIUMStored XSS in KGS Software tia ViewerEPSS 0.2%CVE-2026-116385MEDIUMBdtask Garage 24 Garage Management Software Profile edit_profile cross site scriptingEPSS 0.2%CVE-2025-11824MEDIUMCinza Grid <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Skin Content FieldEPSS 0.2%CVE-2025-57982MEDIUMWordPress Advance Portfolio Grid plugin <= 1.07.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2023-42246MEDIUMSelesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /vam/vam_ep.php.EPSS 0.2%CVE-2024-53744MEDIUMWordPress Elementor Image Gallery plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-53752MEDIUMWordPress Stripe Donation plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-2214MEDIUMcode-projects for Plugin AdminAddAlbum.php cross site scriptingEPSS 0.2%