Weaknesses of type CWE-79

30,519 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-10727MEDIUMReflected XSS in ArkSigner's AcBakImzalaEPSS 0.2%CVE-2024-36064MEDIUMThe NLL com.nll.cb (aka ACR Phone) application through 0.330-playStore-NoAccessibility-arm8 for Android allows any installed application (wiEPSS 0.2%CVE-2025-68658MEDIUMOpen Source Point of Sale (opensourcepos) Stored XSS in Configuration (Information) – Company Name fieldEPSS 0.2%CVE-2026-34161MEDIUMChamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript ExecutionEPSS 0.2%CVE-2026-92551MEDIUMPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Reflected Cross-Site Scripting via ppress_billing_address Filename ParameterEPSS 0.2%CVE-2025-32300HIGHWordPress DZS Video Gallery plugin <= 12.25 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67930HIGHWordPress eHive Search plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-12109MEDIUMHeader Footer Script Adder – Insert Code in Header, Body & Footer <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-84096HIGHWP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form FieldsEPSS 0.2%CVE-2025-69048HIGHWordPress Universal Video Player plugin <= 3.8.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-6365MEDIUMDrupal core - Critical - Cross-site scripting - SA-CORE-2026-001EPSS 0.2%CVE-2026-6696MEDIUMZingaya Click-to-Call <= 1.0 - Reflected Cross-Site Scripting via 'email' ParameterEPSS 0.2%CVE-2025-69084HIGHWordPress Photo Gallery plugin <= 2.7.7.26 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-27504MEDIUMSVXportal <= 2.5 radiomobile_front.php stationid Reflected XSSEPSS 0.2%CVE-2025-69085HIGHWordPress JobBank plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-69056HIGHWordPress Hotel Listing plugin <= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67922HIGHWordPress Grand Restaurant theme < 7.0.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-120488MEDIUMLaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block ContentEPSS 0.2%CVE-2026-21904MEDIUMJunos Space: ilpFilter field on nLegacy.jsp is vulnerable to reflected cross-site script injectionEPSS 0.2%CVE-2025-31101MEDIUMWordPress VaultRE Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%