Weaknesses of type CWE-79

30,525 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-6681MEDIUMFan Page <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via width ParameterEPSS 0.2%CVE-2025-40990MEDIUMStored XSS in Creativeitem Ekushey CRMEPSS 0.2%CVE-2025-48113MEDIUMWordPress Broadstreet plugin <= 1.51.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-60646MEDIUMA stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api v1.3.0 attackers to execute arbitrary web scripts or HEPSS 0.2%CVE-2025-59821MEDIUMDNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profileEPSS 0.2%CVE-2025-6692MEDIUMYouTube Embed <= 10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via instance ParameterEPSS 0.2%CVE-2025-7648MEDIUMRuven Themes: Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-48215MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via circle.php frm_id ParameterEPSS 0.2%CVE-2023-31218HIGHWordPress WOLF Plugin <= 1.0.6 is vulnerable to CSRF leading to Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-43184MEDIUMIBM Jazz Foundation cross-site scriptingEPSS 0.2%CVE-2026-61807MEDIUMSnipe-IT: Stored DOM XSS via table selected-count IDsEPSS 0.2%CVE-2026-48223MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via ics213rr.php frm_add_str ParameterEPSS 0.2%CVE-2025-46263MEDIUMWordPress Author Box After Posts plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-36054MEDIUMCross-site scripting vulnerability affect IBM Business Automation Workflow Process Federation Server -EPSS 0.2%CVE-2025-13938MEDIUMWatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Autotask Technology Integration ConfigurationEPSS 0.2%CVE-2025-54759MEDIUMSantesoft Sante PACS Server Cross-site ScriptingEPSS 0.2%CVE-2026-103249MEDIUMn8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource LocatorEPSS 0.2%CVE-2026-33411MEDIUMDiscourse's solved topic stream has potential stored XSS in topic titleEPSS 0.2%CVE-2025-5684MEDIUMMetForm <= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM ElementEPSS 0.2%CVE-2025-63514MEDIUMkishan0725 Hospital Management System has a Cross-Site Scripting (XSS) vulnerability in appsearch.php via the email parameter.EPSS 0.2%