Weaknesses of type CWE-79

30,470 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-63048MEDIUMWordPress ListingPro Lead Form plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-29660MEDIUMCross Site Scripting vulnerability in DedeCMS v.5.7 allows a local attacker to execute arbitrary code via a crafted payload to the stepselecEPSS 0.2%CVE-2025-12830MEDIUMBetter Elementor Addons <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider WidgetEPSS 0.2%CVE-2025-60917MEDIUMA reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas beforEPSS 0.2%CVE-2025-13971MEDIUMTWW Protein Calculator <= 1.0.24 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Header' SettingEPSS 0.2%CVE-2026-2721MEDIUMMailArchiver <= 4.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via SettingsEPSS 0.2%CVE-2026-20088MEDIUMCisco Integrated Management Controller Cross-Site Scripting VulnerabilityEPSS 0.2%CVE-2025-63061MEDIUMWordPress KALLYAS theme < 4.25.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-63059MEDIUMWordPress Ninja Popups plugin <= 4.7.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-29412MEDIUMA cross-site scripting (XSS) vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows attackers to execuEPSS 0.2%CVE-2026-5112HIGHGravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in RepeaterEPSS 0.2%CVE-2025-0354MEDIUMCross-site scripting vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1EPSS 0.2%CVE-2024-52888MEDIUMStored-XSSEPSS 0.2%CVE-2025-31473MEDIUMWordPress WP Database Optimizer plugin <= 1.2.1.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-31472MEDIUMWordPress Flatty plugin <= 2.0.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-63050MEDIUMWordPress REHub Framework plugin < 19.9.9.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-3242MEDIUMConcrete CMS below 9.4.8 is vulnerable to Stored XSS in the Switch Language blockEPSS 0.2%CVE-2026-1191MEDIUMJavaScript Notifier <= 1.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin SettingsEPSS 0.2%CVE-2025-14393MEDIUMWpik WordPress Basic Ajax Form <= 1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-61825HIGHcode16/sharp has a stored XSS via data-html-content Sanitizer BypassEPSS 0.2%