Weaknesses of type CWE-79

30,539 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-9854MEDIUMA Simple Multilanguage Plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-4965MEDIUMWPBakery Page Builder <= 8.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via Grid BuilderEPSS 0.2%CVE-2025-9030MEDIUMMajestic Before After Image <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2024-58344MEDIUMCarbon Forum 5.9.0 Persistent XSS via Forum Name FieldEPSS 0.2%CVE-2025-59896MEDIUMAuthenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise ServerEPSS 0.2%CVE-2025-9346MEDIUMBooking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-59899MEDIUMAuthenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise ServerEPSS 0.2%CVE-2025-7781MEDIUMWP JobHunt <= 7.6 - Authenticated (Candidate+) Stored Cross-Site Scripting via ‘cs_job_title’EPSS 0.2%CVE-2025-9850MEDIUMEvenium <= 1.3.11 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2024-7075MEDIUMReflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 ProductsEPSS 0.2%CVE-2025-70091MEDIUMA cross-site scripting (XSS) vulnerability in the Customers function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripEPSS 0.2%CVE-2026-63002MEDIUMREDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem FilenamesEPSS 0.2%CVE-2019-25367MEDIUMArangoDB Community Edition 3.4.2-1 XSS via aardvark admin interfaceEPSS 0.2%CVE-2025-4951MEDIUMEditions of Rapid7 AppSpider Pro before version 7.5.018 is vulnerable to a stored cross-site scripting vulnerability in the "ScanName" fieldEPSS 0.2%CVE-2026-21432MEDIUMEmlog has stored Cross-site Scripting issue that can lead to admin or another account ATOEPSS 0.2%CVE-2025-7400MEDIUMFeatured Image from URL (FIFU) <= 5.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image Custom FieldsEPSS 0.2%CVE-2026-50183MEDIUMWWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery SectionEPSS 0.2%CVE-2026-54682HIGHDiscordChatExporter: Stored XSS in HTML export when markdown formatting is disabledEPSS 0.2%CVE-2025-5559MEDIUMTimeZoneCalculator <= 3.37 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-5585MEDIUMSiteOrigin Widgets Bundle <= 1.68.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-url` DOM Element AttributeEPSS 0.2%