Weaknesses of type CWE-79

30,587 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-12828MEDIUMUltra Addons Lite for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Type Out WidgetEPSS 0.2%CVE-2025-52563MEDIUMChamilo: Reflected XSS via page parameterEPSS 0.2%CVE-2026-27756MEDIUMSODOLA SL902-SWTGW124AS <= 200.1.20 Reflected XSS in Management InterfaceEPSS 0.2%CVE-2025-59546LOWDNN Vulnerable to Stored XSS Using Backend Admin CredentialsEPSS 0.2%CVE-2026-114693MEDIUMWordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-50231MEDIUMLyrion Music Server 9.2.0 Unauthenticated Stored XSS via server.logEPSS 0.2%CVE-2026-44245MEDIUMKyverno: [policy-reporter-ui] XSS via Stored Property Values in PropertyCard ComponentEPSS 0.2%CVE-2026-34974MEDIUMphpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege EscalationEPSS 0.2%CVE-2025-2163MEDIUMZoorum Comments <= 0.9 - Cross-Site Request Forgery to Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-45228MEDIUMQuark Drive (quark-auto-save) < 0.8.5 Stored XSS via System ConfigurationEPSS 0.2%CVE-2025-59539MEDIUMDNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography fieldEPSS 0.2%CVE-2025-62731MEDIUMStored XSS in SOPlanningEPSS 0.2%CVE-2026-26291MEDIUMStored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier. If this vulnerability is exploited, an arbitrary script may beEPSS 0.2%CVE-2026-64628MEDIUMGrav Stored Cross-Site Scripting via Shortcode Attribute HandlersEPSS 0.2%CVE-2026-114194MEDIUMWordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-34897MEDIUMWordPress Media LIbrary Assistant plugin <= 3.34 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-82161MEDIUMDell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-sEPSS 0.2%CVE-2026-114184MEDIUMWordPress Elementor Addon Elements plugin <= 1.14.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62326MEDIUMHCL Digital Experience is susceptible to stored cross-site scripting (XSS)EPSS 0.2%CVE-2025-51662MEDIUMA stored cross-site scripting (XSS) vulnerability is found in the text sharing feature of FileCodeBox version 2.2 and earlier. Insufficient EPSS 0.2%