Weaknesses of type CWE-79

30,338 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-23734HIGHWordPress Gigaom Sphinx plugin <= 0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-43824MEDIUMThe Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2EPSS 0.2%CVE-2024-38507LOWIn JetBrains Hub before 2024.2.34646 stored XSS via project description was possibleEPSS 0.2%CVE-2025-23522HIGHWordPress HM Portfolio plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2019-25369MEDIUMOPNsense 19.1 Stored XSS via system_advanced_sysctl.phpEPSS 0.2%CVE-2025-65591MEDIUMnopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality.EPSS 0.2%CVE-2026-56354MEDIUMn8n - Cross-Site Scripting and Open Redirect in Form NodeEPSS 0.2%CVE-2025-23839HIGHWordPress Sticky Button plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-47932HIGHCombodo iTop vulnerable to reflected XSS in ajax.render.php render_dashboardEPSS 0.2%CVE-2026-47096MEDIUMAJA HELO Plus < 2.1.7 Stored XSS via System Name ParameterEPSS 0.2%CVE-2025-15201MEDIUMSohuTV CacheCloud WebResourceController.java redirectNoPower cross site scriptingEPSS 0.2%CVE-2025-40627MEDIUMReflected Cross-Site Scripting (XSS) in AbanteCartEPSS 0.2%CVE-2024-9017MEDIUMPeepSo Core: Groups <= 6.4.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group DescriptionEPSS 0.2%CVE-2025-23838HIGHWordPress Bauernregeln Plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-23622HIGHWordPress CBX Accounting & Bookkeeping plugin <= 1.3.14 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-23885HIGHWordPress MJ Contact us Plugin <= 5.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-12516MEDIUMCoupon Plugin <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-0747HIGHStored Cross-Site vulnerability in EmbedAIEPSS 0.2%CVE-2026-23970HIGHWordPress Redirection for Contact Form 7 plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-50810MEDIUMhopetree izone lts c011b48 contains a Cross Site Scripting (XSS) vulnerability in the article comment function. In \apps\comment\views.py, AEPSS 0.2%