Weaknesses of type CWE-79

30,540 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-2069MEDIUMA cross-site scripting vulnerability was reported in the FileZ client that could allow execution of code if a crafted url is visited by a loEPSS 0.2%CVE-2025-59757MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-64984MEDIUMKaspersky has fixed a security issue in Kaspersky Endpoint Security for Linux (any version with anti-virus databases prior to 18.11.2025), KEPSS 0.2%CVE-2025-59773MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2026-5077MEDIUMTotal <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Blog Section Image alt AttributeEPSS 0.2%CVE-2025-22491MEDIUMImproper Input Validation in Foreseer Reporting Software (FRS)EPSS 0.2%CVE-2026-2485MEDIUMIBM InfoSphere Information Server Cross-Site ScriptingEPSS 0.2%CVE-2025-40903MEDIUMHTML injection in Schedule Restore Archive in Guardian/CMC before 26.1.0EPSS 0.2%CVE-2025-54862MEDIUMSantesoft Sante PACS Server Cross-site ScriptingEPSS 0.2%CVE-2025-43761MEDIUMA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.QEPSS 0.2%CVE-2026-5362MEDIUMPimcore Platform v12.3.3 - Stored XSS in Document Editable Embed renderingEPSS 0.2%CVE-2026-38947MEDIUMFluentCMS 1.2.3 is vulnerable to Cross Site Scripting (XSS) in TextHTML plugin.EPSS 0.2%CVE-2025-59768MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-64047MEDIUMOpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /user/user-move.php.EPSS 0.2%CVE-2025-59766MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-60933MEDIUMMultiple stored cross-site scripting (XSS) vulnerabilities in the Future Goals function of HR Performance Solutions Performance Pro v3.19.17EPSS 0.2%CVE-2025-43765MEDIUMA Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024EPSS 0.2%CVE-2026-93367HIGHVisitors Traffic Real Time Statistics Pro <= 11.22 - Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title)EPSS 0.2%CVE-2025-59752MEDIUMMultiple vulnerabilities in AndSoft's e-TMSEPSS 0.2%CVE-2025-11860MEDIUMTwitter Feed <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%