Weaknesses of type CWE-79

30,536 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-42973MEDIUMCross-Site Scripting (XSS) vulnerability in SAP Data Services (DQ Report)EPSS 0.2%CVE-2025-62482MEDIUMZoom Workplace for Windows - Cross-site ScriptingEPSS 0.2%CVE-2021-47911MEDIUMAffiliate Pro 1.7 Reflected Cross-Site Scripting via Index ModuleEPSS 0.2%CVE-2022-50959MEDIUMWordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.phpEPSS 0.2%CVE-2026-38569MEDIUMHireFlow v1.2 is vulnerable to Cross Site Scripting (XSS) in candidate_detail.html via the Resume or Feedback Comment fields via POST /candiEPSS 0.2%CVE-2025-67991HIGHWordPress User Extra Fields plugin <= 16.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67618HIGHWordPress Brookside theme <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-46518HIGHOpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographicsEPSS 0.2%CVE-2026-91049MEDIUMEWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load AttributeEPSS 0.2%CVE-2025-68846HIGHWordPress Asynchronous Javascript plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-45106MEDIUMWeblate: Stored HTML injection in editor search previewEPSS 0.2%CVE-2025-10558HIGHStored Cross-site Scripting (XSS) vulnerability affecting 3DSearch in 3DSwymer on Release 3DEXPERIENCE R2025xEPSS 0.2%CVE-2026-7421MEDIUMPasseum Ticketing <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'shop_name' SettingEPSS 0.2%CVE-2026-121928MEDIUMInfiniFlow RAGFlow Images API file_utils.py cross site scriptingEPSS 0.2%CVE-2025-27259LOWEricsson Network Manager: improper neutralization of user controlled inputEPSS 0.2%CVE-2026-103897MEDIUMResponsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' AttributeEPSS 0.2%CVE-2025-0876MEDIUMXSS in Isin Basi Advertisement & IT's WorkifEPSS 0.2%CVE-2025-69390HIGHWordPress Business Template Blocks for WPBakery (Visual Composer) Page Builder plugin <= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68031HIGHWordPress افزونه پیامک حرفه ای فراز اس ام اس plugin <= 2.7.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-109988MEDIUMProduct Addons for Woocommerce <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field ParameterEPSS 0.2%