Weaknesses of type CWE-79

30,539 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-10189MEDIUMBP Direct Menus <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-65540MEDIUMMultiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. User input fields suEPSS 0.2%CVE-2026-24952MEDIUMWordPress Seriously Simple Podcasting plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-61453MEDIUMGrav before 2.0.1 XSS via Twig String ConcatenationEPSS 0.2%CVE-2026-27156MEDIUMNiceGUI has XSS via Code InjectionEPSS 0.2%CVE-2026-116854MEDIUMWordPress WP Customer Area plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-3217MEDIUMSAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018EPSS 0.2%CVE-2026-32703CRITICALOpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security PolicyEPSS 0.2%CVE-2026-24958MEDIUMWordPress JetElements For Elementor plugin <= 2.7.12.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67448HIGHThe SMS module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to stored XSS. The application does not properly sanitize uEPSS 0.2%CVE-2025-10490MEDIUMZephyr Project Manager <= 3.3.202 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-22463MEDIUMWordPress Form to Chat App plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-54704MEDIUMWordPress Easy Elementor Addons plugin <= 2.2.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-4596MEDIUMprojectworlds Lawyer Management System lawyers.php cross site scriptingEPSS 0.2%CVE-2025-52710MEDIUMWordPress File Manager Pro plugin <= 1.8.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-12124MEDIUMFitVids for WordPress <= 4.0.1 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-12098MEDIUMPowerPress Podcasting plugin by Blubrry <= 11.16.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'embed' Episode Meta FieldEPSS 0.2%CVE-2025-66444HIGHCross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center AnalyzerEPSS 0.2%CVE-2026-6095MEDIUMOrejime - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-032EPSS 0.2%CVE-2026-25743HIGHOpenEMR has Stored XSS in Questionnaire answersEPSS 0.2%