Weaknesses of type CWE-79

30,537 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-66460MEDIUMLookyloo vulnerable to XSS due to lack of escaping in HTML elements passed to DatatablesEPSS 0.2%CVE-2025-53222HIGHWordPress tagDiv Opt-In Builder plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-61431MEDIUMA reflected cross-site scripted (XSS) vulnerability in the /jsp/gsfr_feditorHTML.jsp endpoint of Zucchetti ZMaintenance Infinity and InfinitEPSS 0.2%CVE-2025-6396MEDIUMXSS in Webbeyaz's web siteEPSS 0.2%CVE-2025-68978MEDIUMWordPress DesignThemes Core plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-7296MEDIUMSourceCodester Pizzafy Ecommerce System ajax.php save_order cross site scriptingEPSS 0.2%CVE-2025-14274MEDIUMUnlimited Elements for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero WidgetEPSS 0.2%CVE-2025-63885MEDIUMA stored cross-site scripting (XSS) vulnerability in AIxBlock commit 04f305 allows attackers to execute arbitrary web scripts or HTML via inEPSS 0.2%CVE-2025-49389MEDIUMWordPress Notice Bar Plugin <= 3.1.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-54050MEDIUMWordPress Responsive Addons for Elementor plugin <= 1.7.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-8136MEDIUMSourceCodester Pharmacy Sales and Inventory System index.php users cross site scriptingEPSS 0.2%CVE-2025-54965MEDIUMAn XSS issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service does not properly sanitize the job ID parameteEPSS 0.2%CVE-2025-26258MEDIUMSourcecodester Employee Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via 'Add Designation.'EPSS 0.2%CVE-2025-50733MEDIUMNextChat contains a cross-site scripting (XSS) vulnerability in the HTMLPreview component of artifacts.tsx that allows attackers to execute EPSS 0.2%CVE-2025-61933MEDIUMBIG-IP APM cross-site scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-108934MEDIUMEdimax BR-6208AC HTTP Blocking formUrlb cross site scriptingEPSS 0.2%CVE-2025-12083MEDIUMCivicTheme Design System - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-113EPSS 0.2%CVE-2025-10955MEDIUMHTML Injection in Netcad Software's NetigmaEPSS 0.2%CVE-2026-36358MEDIUMCross Site Scripting vulnerability in Juzaweb CMS v.5.0.0 allows a remote attacker via execute arbitrary code via a crafted script to the AdEPSS 0.2%CVE-2024-45753MEDIUMIn Mahara 23.04.8 and 24.04.4, the external RSS feed block can cause XSS if the external feed XML has a malicious value for the link attribuEPSS 0.2%