Weaknesses of type CWE-79

30,332 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-65591MEDIUMnopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality.EPSS 0.2%CVE-2024-38507LOWIn JetBrains Hub before 2024.2.34646 stored XSS via project description was possibleEPSS 0.2%CVE-2025-23734HIGHWordPress Gigaom Sphinx plugin <= 0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-12457MEDIUMEnable SVG, WebP, and ICO Upload <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadsEPSS 0.2%CVE-2025-0747HIGHStored Cross-Site vulnerability in EmbedAIEPSS 0.2%CVE-2024-12516MEDIUMCoupon Plugin <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-23885HIGHWordPress MJ Contact us Plugin <= 5.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-40875HIGHmailcow: dockerized vulnerable to stored XSS in user login history real_ripEPSS 0.2%CVE-2025-40627MEDIUMReflected Cross-Site Scripting (XSS) in AbanteCartEPSS 0.2%CVE-2024-9017MEDIUMPeepSo Core: Groups <= 6.4.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group DescriptionEPSS 0.2%CVE-2025-23622HIGHWordPress CBX Accounting & Bookkeeping plugin <= 1.3.14 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-40626MEDIUMReflected Cross-Site Scripting (XSS) in AbanteCartEPSS 0.2%CVE-2025-23838HIGHWordPress Bauernregeln Plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-47703MEDIUMCOOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-049EPSS 0.2%CVE-2025-30143MEDIUMRule 3000216 (before version 2) in Akamai App & API Protector (with Akamai ASE) before 2024-12-10 does not properly consider JavaScript variEPSS 0.2%CVE-2026-111820HIGHAnalytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page TitleEPSS 0.2%CVE-2024-43808LOWIn JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault pluginEPSS 0.2%CVE-2025-15201MEDIUMSohuTV CacheCloud WebResourceController.java redirectNoPower cross site scriptingEPSS 0.2%CVE-2025-23621HIGHWordPress Causes – Donation plugin <= 1.0.01 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-23994HIGHWordPress Estatebud – Properties & Listings plugin <= 5.5.0 - CSRF to Settings Update & Stored XSS vulnerabilityEPSS 0.2%