Weaknesses of type CWE-79

30,371 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-27824MEDIUMAn XSS issue was discovered in the Link iframe formatter module before 1.x-1.1.1 for Backdrop CMS. It doesn't sufficiently sanitize input beEPSS 0.2%CVE-2026-81635MEDIUMA cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of aEPSS 0.2%CVE-2025-57665MEDIUMElement Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abEPSS 0.2%CVE-2024-11405MEDIUMWP Front-end login and register <= 2.1.0 - Reflected Cross-Site ScriptingEPSS 0.2%CVE-2025-65417MEDIUMdocuFORM Managed Print Service Client 11.11c is vulnerable to a reflected cross site scripting attack via the login page of the application.EPSS 0.2%CVE-2025-23943MEDIUMWordPress PDF.js Shortcode plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-53300MEDIUMWordPress Podcast Feed Player Widget and Shortcode plugin <= 2.2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-25642MEDIUMHedgeDoc security headers for uploaded files were not workingEPSS 0.2%CVE-2025-23965MEDIUMWordPress Kopa Nictitate Toolkit plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-53301MEDIUMWordPress Theme Junkie Team Content plugin <= 0.1.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-42956MEDIUMMultiple vulnerabilities in SAP NetWeaver Application Server ABAPEPSS 0.2%CVE-2025-22780MEDIUMWordPress wp-pano Plugin <= 1.17 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2022-43850MEDIUMIBM Aspera Console cross-site scriptingEPSS 0.2%CVE-2025-23926MEDIUMWordPress Ajax WP Query Search Filter plugin <= 1.0.7 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-50046MEDIUMWordPress WPComplete plugin <= 2.9.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2023-53978MEDIUMmyBB Forums 1.8.26 Stored Cross-Site Scripting via Forum AnnouncementsEPSS 0.2%CVE-2025-50041MEDIUMWordPress Gutenberg Blocks – ACF Blocks Suite plugin <= 2.6.11 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-22798MEDIUMWordPress Responsive jQuery Slider plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-57783HIGHThe desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to thEPSS 0.2%CVE-2024-56475MEDIUMIBM TXSeries for Multiplatforms cross-site scriptingEPSS 0.2%