Weaknesses of type CWE-79

30,495 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-71275MEDIUMOpenBK7231T - Reflected XSS via OTA host ParameterEPSS 0.2%CVE-2025-43769MEDIUMStored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024EPSS 0.2%CVE-2025-22635HIGHWordPress Eventer - WordPress Event & Booking Manager Plugin plugin < 3.9.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-13712MEDIUMDivi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URLEPSS 0.2%CVE-2025-69003HIGHWordPress KenthaRadio theme <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-4770MEDIUMDOM-Based XSS in TR7's WAF-ASPEPSS 0.2%CVE-2024-13642MEDIUMStratum – Elementor Widgets <= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Vulnerability via Image Hotspot WidgetEPSS 0.2%CVE-2024-10539MEDIUMReflected XSS in Uyumsoft's ERPEPSS 0.2%CVE-2025-48323MEDIUMWordPress Advance Food Menu plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-7399MEDIUMBetheme <= 28.1.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-43829MEDIUMStored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay Portal 7.4.3.18 through 7.4.3.111, and LiferEPSS 0.2%CVE-2024-25812MEDIUMMyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the src parameter.EPSS 0.2%CVE-2025-43877MEDIUMWRC-1167GHBK2-S contains a stored cross-site scripting vulnerability in WebGUI. If exploited, an arbitrary script may be executed on the webEPSS 0.2%CVE-2025-15249MEDIUMzhujunliang3 work_platform Content cross site scriptingEPSS 0.2%CVE-2025-60131MEDIUMWordPress Werk aan de Muur Plugin <= 1.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-43822MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2EPSS 0.2%CVE-2025-58596MEDIUMWordPress MailOptin Plugin <= 1.2.75.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2024-25814MEDIUMMyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the msg parameter.EPSS 0.2%CVE-2025-60146MEDIUMWordPress Map Categories to Pages Plugin <= 1.3.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-85293MEDIUMInvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer FormsEPSS 0.2%