Weaknesses of type CWE-79

30,525 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-50592MEDIUMCross site scripting vulnerability in seacms before 13.2 via the vid parameter to Upload/js/player/dmplayer/player.EPSS 0.2%CVE-2025-52776HIGHWordPress Video List Manager plugin <= 1.7 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-13959MEDIUMFilestack <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2025-55735MEDIUMflaskBlog Stored XSS VulnerabilityEPSS 0.2%CVE-2026-53606MEDIUMsanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributesEPSS 0.2%CVE-2026-18361HIGHDFIR-IRIS Stored XSS in Datastore UploadEPSS 0.2%CVE-2014-125132MEDIUMBlogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blogroll.phpEPSS 0.2%CVE-2025-52799HIGHWordPress LMS theme <= 9.2 - Reflected Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-102374MEDIUMGestSup before 3.2.62 Stored XSS via Double-Decoded Email Subject in OAuth IMAP ConnectorEPSS 0.2%CVE-2026-2735MEDIUMStored Cross-Site Scripting (XSS) vulnerability in Alkacon's OpenCmsEPSS 0.2%CVE-2026-16969HIGHDFIR-IRIS Stored XSS in AssetsEPSS 0.2%CVE-2019-25731MEDIUMZuz Music 2.1 Persistent Cross-site Scripting via zuzconsole ContactEPSS 0.2%CVE-2026-33741MEDIUMEspoCRM: Stored XSS via SVG attachment loading same-origin JavaScriptEPSS 0.2%CVE-2025-59025MEDIUMMalicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the users account, includiEPSS 0.2%CVE-2026-92538MEDIUMLearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' ParameterEPSS 0.2%CVE-2025-12186MEDIUMWeekly Planner <= 1.0 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-52796HIGHWordPress WP-Recall <= 16.26.14 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-6704MEDIUMBlog Settings <= 1.0 - Reflected Cross-Site Scripting via 'page' ParameterEPSS 0.2%CVE-2026-109673HIGHFrappe ERPNext before 16.12.0 Stored XSS via Crafted Record NamesEPSS 0.2%CVE-2026-27119MEDIUMSvelte affected by XSS in SSR `<option>` elementEPSS 0.2%