Weaknesses of type CWE-79

30,522 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-53482MEDIUMIPInfo: Message key XSS through several IPInfo messages in infobox and popupEPSS 0.2%CVE-2025-43771MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay DEPSS 0.2%CVE-2025-36563MEDIUMReflected cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product administrator accesses a crafted URL, an EPSS 0.2%CVE-2021-47725MEDIUMSTVS ProVision 5.9.10 Authenticated Reflected Cross-Site Scripting via Files ParameterEPSS 0.2%CVE-2025-6378MEDIUMResponsive Food and Drink Menu <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_pdf_menus ShortcodeEPSS 0.2%CVE-2025-20328MEDIUMA vulnerability in the user profile component of Cisco Webex Meetings could have allowed an authenticated, remote attacker with low privilegEPSS 0.2%CVE-2025-13744HIGHImproper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed rendering of malicious HTMLEPSS 0.2%CVE-2026-25133MEDIUMOctober CMS has Stored XSS via SVG Filter BypassEPSS 0.2%CVE-2025-67723MEDIUMDiscourse vulnerable to stored Cross-site Scripting via Katex in discourse-math pluginEPSS 0.2%CVE-2025-4284MEDIUMReflected XSS in Rolantis Information Technologies' AgentisEPSS 0.2%CVE-2025-20356MEDIUMCisco CyberVision Center Sensor Explorer Stored Cross-Site Scripting VulnerabilityEPSS 0.2%CVE-2026-121515MEDIUMFV Flowplayer Video Player <= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.2%CVE-2025-43787MEDIUMA Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0, 2025.Q2.0 through 202EPSS 0.2%CVE-2026-2029MEDIUMLivemesh Addons for Beaver Builder <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' and 'value' Shortcode AttributesEPSS 0.2%CVE-2025-53121MEDIUMStored XSS in multiple 33.0.8files in opennms/opennmsEPSS 0.2%CVE-2025-52782HIGHWordPress Scroll UP plugin <= 2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-53488MEDIUMStored XSS in WikiHieroEPSS 0.2%CVE-2026-0563MEDIUMWP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpgsv_map' ShortcodeEPSS 0.2%CVE-2025-50869MEDIUMA stored Cross-Site Scripting (XSS) vulnerability exists in the qureydetails.php page of Institute-of-Current-Students 1.0, where the input EPSS 0.2%CVE-2025-41439MEDIUMA reflected cross-site scripting vulnerability via a specific parameter exists in SLNX Help Documentation of RICOH Streamline NX. If this vuEPSS 0.2%