Weaknesses of type CWE-79

30,509 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-61190MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability has been identified in DSpace JSPUI 6.5 within the search/discover filtering functionalEPSS 0.2%CVE-2026-35013MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via street_view.php thelat and thelng ParametersEPSS 0.2%CVE-2026-35011MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call ParameterEPSS 0.2%CVE-2025-41442MEDIUMAdvantech iView Cross-site ScriptingEPSS 0.2%CVE-2025-56276MEDIUMcode-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting (XSS) in the registration function. An attacker enters mEPSS 0.2%CVE-2026-35016MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via search.php frm_query ParameterEPSS 0.2%CVE-2026-103493HIGHIn JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possibleEPSS 0.2%CVE-2025-56280MEDIUMcode-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting (XSS) in the area where users submit reservation informaEPSS 0.2%CVE-2026-116761MEDIUMCMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End FormEPSS 0.2%CVE-2025-11570MEDIUMVersions of the package drupal-pattern-lab/unified-twig-extensions from 0.0.0 are vulnerable to Cross-site Scripting (XSS) due to insufficieEPSS 0.2%CVE-2025-68387MEDIUMKibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.2%CVE-2025-67990HIGHWordPress GMap Targeting plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-103421MEDIUMWPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path SegmentEPSS 0.2%CVE-2025-65858LOWA Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username'EPSS 0.2%CVE-2026-78471MEDIUMAutoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author NameEPSS 0.2%CVE-2026-35010MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id ParameterEPSS 0.2%CVE-2026-35012MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id ParameterEPSS 0.2%CVE-2026-54432MEDIUMRoundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS). The issue occurs because the attachment MIMEPSS 0.2%CVE-2026-35007MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id ParameterEPSS 0.2%CVE-2026-22154MEDIUMAn improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSOAR PaaS 7.6.0 throuEPSS 0.2%