Weaknesses of type CWE-79

30,496 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-57873MEDIUMBUG-000175222 - Reflected XSS vulnerability in Portal for ArcGIS.EPSS 0.2%CVE-2026-24671MEDIUMOpen eClass is Vulnerable to Stored Cross-Site Scripting (XSS) in Multiple High-Privilege User FieldsEPSS 0.2%CVE-2025-59986MEDIUMJunos Space: Input fields in Model Devices are vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-60009MEDIUMJunos Space: CLI Configlet page is vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-64613MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2025-20280MEDIUMCisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting VulnerabilityEPSS 0.2%CVE-2026-2583MEDIUMBlocksy <= 2.1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via `blocksy_meta` FieldsEPSS 0.2%CVE-2026-24665HIGHOpen eClass is Vulnerable to Stored Cross-Site Scripting (XSS) via Student Assignment UploadEPSS 0.2%CVE-2025-55105MEDIUMBUG-000177336 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.EPSS 0.2%CVE-2025-57877MEDIUMReflected XSS vulnerability in Portal for ArcGIS.EPSS 0.2%CVE-2025-14113MEDIUMViitor Button Shortcodes <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode AttributeEPSS 0.2%CVE-2025-47662MEDIUMWordPress Woobox plugin <= 1.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-47676MEDIUMWordPress User Login History plugin <= 2.1.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58834MEDIUMWordPress short.io Plugin <= 2.4.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-1458MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-59993MEDIUMJunos Space: Space Node Setting fields are vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-27006MEDIUMWordPress Authorsy Plugin <= 1.0.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58838MEDIUMWordPress Smooth Accordion Plugin <= 2.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-59998MEDIUMJunos Space: Archive Logs screen is vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-58837MEDIUMWordPress SS Font Awesome Icon Plugin <= 4.1.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%