Weaknesses of type CWE-79

30,469 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-3276MEDIUMSKT Blocks – Gutenberg based Page Builder <= 1.9 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-63743MEDIUMCross-Site Scripting vulnerability in the Snipe-IT web-based asset management system v8.3.0 to up and including v8.3.1 allows authenticated EPSS 0.2%CVE-2025-9436MEDIUMWidgets for Google Reviews <= 13.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trustindex ShortcodeEPSS 0.2%CVE-2025-23227MEDIUMIBM Tivoli Application Dependency Discovery Manager cross-site scriptingEPSS 0.2%CVE-2025-39365HIGHWordPress wProject theme < 5.8.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-57897HIGHWordPress Logtik theme <= 2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-39392HIGHWordPress WPAMS plugin <= 44.0 (17-08-2023) - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-47107MEDIUMIBM QRadar SIEM cross-site scriptingEPSS 0.2%CVE-2025-39393HIGHWordPress Hospital Management System plugin <= 47.0(20-11-2023) - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-26193HIGHOpen WebUI vulnerable to Stored XSS via iFrame embeds in response messagesEPSS 0.2%CVE-2026-32308HIGHOneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")EPSS 0.2%CVE-2025-5531MEDIUMStaff Directory – Employee Directory for WordPress <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-0813MEDIUMShort Link <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Administration Settings PageEPSS 0.2%CVE-2025-5539MEDIUMSimplify Contact Management: WP Easy Contact <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-0930MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in TeamCal NeoEPSS 0.2%CVE-2025-61427MEDIUMA reflected cross-site scripting (XSS) vulnerability in BEO GmbH BEO Atlas Einfuhr Ausfuhr 3.0 allows attackers to execute arbitrary code inEPSS 0.2%CVE-2025-13672HIGHReflected Cross-Site Scripting discovered in OpenText WSM Management Server.EPSS 0.2%CVE-2025-39407HIGHWordPress Memberpress plugin < 1.12.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-2808MEDIUMMotors – Car Dealership & Classified Listings Plugin <= 1.4.63 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-12537MEDIUMAddon Elements for Elementor <= 1.14.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%