Weaknesses of type CWE-79

30,522 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-20357MEDIUMCisco CyberVision Center Reports Stored Cross-Site Scripting VulnerabilityEPSS 0.2%CVE-2025-49940MEDIUMWordPress Fusion Builder plugin <= 3.13.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-22815MEDIUMWordPress Button Block plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-1825MEDIUMShow YouTube video <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode AttributeEPSS 0.2%CVE-2025-5564MEDIUMGC Social wall <= 1.15 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-43740MEDIUMA Stored cross-site scripting vulnerability in the Liferay Portal 7.4.3.120 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.8, EPSS 0.2%CVE-2025-43775MEDIUMStored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.5, 2024EPSS 0.2%CVE-2025-61788MEDIUMOpencast Paella Player 7 vulnerable to Cross-Site-ScriptingEPSS 0.2%CVE-2025-68889HIGHWordPress Pinpoll plugin <= 4.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-47677MEDIUMWordPress Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery plugin <= 2.7.7.25 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-8143MEDIUMSoledad <= 8.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pcsml_smartlists_h'EPSS 0.2%CVE-2025-7058MEDIUMKingcabs <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via progressbarLayout ParameterEPSS 0.2%CVE-2025-12965MEDIUMMagical Posts Display <= 1.2.54 - Authenticated (Author+) Stored Cross-Site Scripting via Magical Posts Accordion WidgetEPSS 0.2%CVE-2025-34264MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via dog/{agentId}EPSS 0.2%CVE-2025-13705MEDIUMCustom Frames <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode ParameterEPSS 0.2%CVE-2025-34265MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via rule-enginesEPSS 0.2%CVE-2025-14121MEDIUMEDD Download Info <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2025-41036MEDIUMStored Cross-Site Scripting vulnerability in appRain CMFEPSS 0.2%CVE-2025-60506MEDIUMMoodle PDF Annotator plugin v1.5 release 9 allows stored cross-site scripting (XSS) via the Public Comments feature. An attacker with a low-EPSS 0.2%CVE-2025-63243MEDIUMA reflected cross-site scripting (XSS) vulnerability exists in the password change functionality of Pixeon WebLaudos 25.1 (01). The sle_sSenEPSS 0.2%