Weaknesses of type CWE-79

30,539 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-59760MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-59767MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-59026MEDIUMMalicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be exEPSS 0.2%CVE-2025-30186MEDIUMMalicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be exEPSS 0.2%CVE-2026-0868MEDIUMEMC Scheduling Manager <= 4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via calendly ShortcodeEPSS 0.2%CVE-2026-38935MEDIUMA reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/view.php via the doctype parameterEPSS 0.2%CVE-2025-40902MEDIUMHTML injection in Users in Guardian/CMC before 26.1.0EPSS 0.2%CVE-2025-10927MEDIUMPlausible tracking - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-107EPSS 0.2%CVE-2025-57973MEDIUMWordPress WP-Members Plugin <= 3.5.4.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-26272MEDIUMHomeBox affected by Stored XSS via HTML/SVG Attachment UploadEPSS 0.2%CVE-2025-40901MEDIUMHTML injection in Credentials Manager in Guardian/CMC before 26.1.0EPSS 0.2%CVE-2026-38936MEDIUMA reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/selectindices.php via the namecontains EPSS 0.2%CVE-2023-38375MEDIUMIBM Cloud Pak System Cross-Site ScriptingEPSS 0.2%CVE-2026-23613MEDIUMGFI MailEssentials AI < 22.4 Anti-Spam URI DNS Blocklist Domain Stored XSSEPSS 0.2%CVE-2025-59751MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-59762MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2026-88963MEDIUMTutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' ParameterEPSS 0.2%CVE-2025-59750MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-10853MEDIUMReflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output EncodingEPSS 0.2%CVE-2025-59759MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%