Weaknesses of type CWE-79

30,593 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-66420MEDIUMTryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67.EPSS 0.2%CVE-2026-12459MEDIUMInappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to inject arbitrary scripts or HTMEPSS 0.2%CVE-2026-1569MEDIUMWueen <= 0.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's ShortcodeEPSS 0.2%CVE-2025-65134MEDIUMIn manikandan580 School-management-system 1.0, a reflected cross-site scripting (XSS) vulnerability exists in /studentms/admin/contact-us.phEPSS 0.2%CVE-2024-53735HIGHWordPress iPhone Webclip Manager plugin <= 0.5 - CSRF to Stored XSS vulnerabilityEPSS 0.2%CVE-2026-8885MEDIUMDeMomentSomTres Shortcodes <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-0618MEDIUMCross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell Universal: before 4.5.6, before 5.6.13.EPSS 0.2%CVE-2026-41467MEDIUMProjeQtor < 12.4.4 Stored XSS via checkValidFileName()EPSS 0.2%CVE-2026-37216MEDIUMRuoyi 4.8.2 is vulnerable to Cross Site Scripting (XSS) at the interface /system/notice/add.EPSS 0.2%CVE-2026-114538HIGHBootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236EPSS 0.2%CVE-2025-13196MEDIUMElement Pack Addons for Elementor <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map widgetEPSS 0.2%CVE-2026-114525HIGHABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224EPSS 0.2%CVE-2025-1794MEDIUMAM LottiePlayer <= 3.6.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVGEPSS 0.2%CVE-2026-62082HIGHWordPress Pin WP theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-42210HIGHHCL Unica Marketing Operations v12.1.8 and lower is affected by a Stored cross-site scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-114528HIGHZero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222EPSS 0.2%CVE-2026-30563MEDIUMA Stored Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located in tEPSS 0.2%CVE-2026-119488HIGHWordPress Pie Register plugin <= 3.8.4.15 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-14449MEDIUMBA Book Everything <= 1.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via babe-search-form ShortcodeEPSS 0.2%CVE-2025-13740MEDIUMLightweight Accordion <= 1.5.20 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%