Weaknesses of type CWE-79

30,509 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-2870MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in Clinic Queuing SystemEPSS 0.2%CVE-2025-11885MEDIUMEchBay Admin Security <= 1.3.0 - Reflected Cross-Site ScriptingEPSS 0.2%CVE-2025-27331MEDIUMWordPress WooCommerce Display Products by Tags plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-48143HIGHWordPress Formulario de contacto SalesUp! plugin <= 1.0.14 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-13894MEDIUMCSV Sumotto <= 1.0 - Reflected Cross-Site ScriptingEPSS 0.2%CVE-2025-40702MEDIUMCross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CHEPSS 0.2%CVE-2025-46227MEDIUMWordPress Custom Related Posts plugin <= 1.7.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-48279HIGHWordPress WC MyParcel Belgium plugin <= 4.5.5-beta - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-14001MEDIUMInappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTMEPSS 0.2%CVE-2026-54192HIGHWordPress Popup box plugin <= 6.2.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-40707MEDIUMCross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CHEPSS 0.2%CVE-2024-37343MEDIUMCross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06EPSS 0.2%CVE-2026-14147MEDIUMInappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UEPSS 0.2%CVE-2025-35029MEDIUMMedical Informatics Engineering Enterprise Health stored cross site scripting via Demographic Information pageEPSS 0.2%CVE-2025-2869MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in Clinic Queuing SystemEPSS 0.2%CVE-2025-27330MEDIUMWordPress PlayerJS plugin <= 2.23 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-32856MEDIUMEllucian Banner Self-Service Reflected XSS via dateConverterEPSS 0.2%CVE-2025-62265MEDIUMCross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and EPSS 0.2%CVE-2026-17845MEDIUMInappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UEPSS 0.2%CVE-2025-40709MEDIUMCross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CHEPSS 0.2%