Weaknesses of type CWE-79

30,539 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-59772MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-59753MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-30190MEDIUMMalicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the cEPSS 0.2%CVE-2026-121627MEDIUMbuku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URLEPSS 0.2%CVE-2026-25956MEDIUMFrappe Affected by XSS and Open Redirect in Sign UpEPSS 0.2%CVE-2025-64046MEDIUMOpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /system/update-run.php.EPSS 0.2%CVE-2026-23615MEDIUMGFI MailEssentials AI < 22.4 Anti-Spam Sender Policy Framework Email Exceptions Description Stored XSSEPSS 0.2%CVE-2026-4790MEDIUMPremium Addons for Elementor <= 4.11.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_svg' ParameterEPSS 0.2%CVE-2026-5070MEDIUMVantage <= 1.20.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Block Text ContentEPSS 0.2%CVE-2025-59771MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2026-121588MEDIUMTeXlyre from 0.11.0 before 0.13.5 Stored XSS via Recipe Icon ImportEPSS 0.2%CVE-2025-60932MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in the Current Goals function of HR Performance Solutions Performance Pro v3.19.1EPSS 0.2%CVE-2025-59761MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-9550MEDIUMFacets - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-100EPSS 0.2%CVE-2025-59755MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-11952MEDIUMStored Cross-Site Scripting (XSS) in Oct8ne ChatbotEPSS 0.2%CVE-2025-59764MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-55054MEDIUMCWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')EPSS 0.2%CVE-2025-41384MEDIUMReflected Cross-Site Scripting (XSS) in SuiteCRMEPSS 0.2%CVE-2025-59758MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%