Weaknesses of type CWE-79

30,537 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-53497MEDIUMStored XSS in RelatedArticlesEPSS 0.2%CVE-2026-44896MEDIUMMistune: XSS via unescaped figclass/figwidth in Figure directiveEPSS 0.2%CVE-2025-59429HIGHFreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status pageEPSS 0.2%CVE-2025-7057MEDIUMStored XSS in QuizEPSS 0.2%CVE-2026-25100MEDIUMStored XSS via SVG File Upload in BluditEPSS 0.2%CVE-2025-8411HIGHXSS in Dokuzsoft Technology's E-Commerce Web Design ProductEPSS 0.2%CVE-2024-42912MEDIUMA cross-site scripting (XSS) vulnerability in META-INF Kft. Email This Issue (Data Center) before 9.13.0-GA allows attackers to execute arbiEPSS 0.2%CVE-2026-105874HIGHWordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-29933MEDIUMA reflected cross-site scripting (XSS) vulnerability in the /index/login.html component of YZMCMS v7.4 allows attackers to execute arbitraryEPSS 0.2%CVE-2026-1001MEDIUMDomoticz < 2026.1 Stored XSS via Hardware Configuration EndpointEPSS 0.2%CVE-2026-8886MEDIUMhk_shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode AttributeEPSS 0.2%CVE-2025-53478MEDIUMCheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate via unsanitized i18n messagesEPSS 0.2%CVE-2026-5106MEDIUMcode-projects Exam Form Submission update_fst.php cross site scriptingEPSS 0.2%CVE-2026-24907MEDIUMOctober CMS has Stored XSS via Event Log Mail PreviewEPSS 0.2%CVE-2025-53480MEDIUMCheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate (Account information tab) via unsanitized i18n messagesEPSS 0.2%CVE-2026-5249MEDIUMgougucms Record Endpoint record.html cross site scriptingEPSS 0.2%CVE-2026-87939MEDIUMFeed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137EPSS 0.2%CVE-2025-40683MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in Human Resource Management SystemEPSS 0.2%CVE-2026-26027HIGHGLPI has an Unauthenticated Stored XSS via inventoryEPSS 0.2%CVE-2025-7362MEDIUMMsUpload: Stored Cross-Site Scripting (XSS) via unsanitized msu-continue system messageEPSS 0.2%