Weaknesses of type CWE-79

30,585 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-57883MEDIUMReflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, EPSS 0.2%CVE-2026-92746MEDIUMGutenverse <= 4.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comment Block 'suffixMain' AttributeEPSS 0.2%CVE-2024-51222MEDIUMA stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Management System v1.0 alEPSS 0.2%CVE-2026-96743MEDIUMTable Field Add-on for ACF and SCF <= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field ValueEPSS 0.2%CVE-2026-93908MEDIUMReal Estate Manager <= 7.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'before_price_text' ParameterEPSS 0.2%CVE-2026-31351MEDIUMAn authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execEPSS 0.2%CVE-2026-8977MEDIUMWP GDPR Cookie Consent <= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ninja_gdpr_ajax_actions' AJAX ActionEPSS 0.2%CVE-2025-51734MEDIUMCross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0.EPSS 0.2%CVE-2026-100694MEDIUMHugo before 0.166.0 Cross-Site Scripting via text/orgEPSS 0.2%CVE-2026-33311MEDIUM@dicebear/core and @dicebear/initials Vulnerable to SVG Injection via Unsanitized OptionsEPSS 0.2%CVE-2025-53504MEDIUMGroup-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability. If this vEPSS 0.2%CVE-2026-6073HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.2%CVE-2025-54407MEDIUMStored cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, andEPSS 0.2%CVE-2026-3218MEDIUMResponsive Favicons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-019EPSS 0.2%CVE-2025-4760MEDIUMAuthenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in PublisherEPSS 0.2%CVE-2026-110384HIGHWordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62752MEDIUMWordPress Calendar.online / Kalender.digital plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-79311MEDIUMwebpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__().EPSS 0.2%CVE-2024-34321MEDIUMProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes pEPSS 0.2%CVE-2026-3004MEDIUMSnow Monkey Blocks <= 24.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-slick' AttributeEPSS 0.2%