Weaknesses of type CWE-79

30,509 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-40708MEDIUMCross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CHEPSS 0.2%CVE-2025-40703MEDIUMCross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CHEPSS 0.2%CVE-2025-57407MEDIUMA stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to injecEPSS 0.2%CVE-2026-27121MEDIUMSvelte affected by cross-site scripting via spread attributes in Svelte SSREPSS 0.2%CVE-2026-17797MEDIUMInappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UEPSS 0.2%CVE-2025-28097MEDIUMOneNav 1.1.0 is vulnerable to Cross Site Scripting (XSS) in custom headers.EPSS 0.2%CVE-2025-1261MEDIUMHT Mega – Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown WidgetEPSS 0.2%CVE-2025-40707MEDIUMCross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CHEPSS 0.2%CVE-2025-39363MEDIUMWordPress Custom Login and Registration <= 1.0.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-27331MEDIUMWordPress WooCommerce Display Products by Tags plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-17827MEDIUMInappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UEPSS 0.2%CVE-2026-114133MEDIUMNuxt server islands render `useHeadSafe` input without sanitisationEPSS 0.2%CVE-2025-46237MEDIUMWordPress Link Library plugin <= 7.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-27122MEDIUMSvelte SSR does not validate dynamic element tag names in `<svelte:element>`EPSS 0.2%CVE-2025-9163MEDIUMHouzez <= 4.1.6 - Unauthenticated Stored Cross-Site Scripting via SVG File UploadEPSS 0.2%CVE-2025-12064MEDIUMWP2Social Auto Publish <= 2.4.7 - Reflected Cross-Site Scripting via PostMessageEPSS 0.2%CVE-2025-12078MEDIUMArtiBot Free Chat Bot for WebSites <= 1.1.7 - Reflected Cross-Site Scripting via PostMessageEPSS 0.2%CVE-2025-40704MEDIUMCross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CHEPSS 0.2%CVE-2026-87869MEDIUMFilter Everything — WordPress & WooCommerce Filters <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URLEPSS 0.2%CVE-2025-27341MEDIUMWordPress Reactive Mortgage Calculator plugin <= 1.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%