Weaknesses of type CWE-79

30,596 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-5769MEDIUMReflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI ModificationEPSS 0.2%CVE-2025-68890HIGHWordPress e-shops plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2021-47981MEDIUMQuick.CMS 6.7 Cross-Site Scripting via CSRF to Sliders FormEPSS 0.2%CVE-2025-41054MEDIUMStored Cross-Site Scripting vulnerability in appRain CMFEPSS 0.2%CVE-2025-58174MEDIUMLAM profile editor stored cross-site scripting vulnerabilityEPSS 0.2%CVE-2026-33405LOWPi-hole has a Stored HTML Injection in queries.jsEPSS 0.2%CVE-2026-40230MEDIUMHelpy 2.8.0 - Stored XSS in knowledgebase Doc body renderingEPSS 0.2%CVE-2025-47566HIGHWordPress ZoomSounds plugin <= 6.91 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-8493MEDIUMColorbox Inline - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-036EPSS 0.2%CVE-2025-61655NONEStored XSS through system messages in VisualEditorEPSS 0.2%CVE-2026-20087MEDIUMCisco Integrated Management Controller Cross-Site Scripting VulnerabilityEPSS 0.2%CVE-2025-58982MEDIUMWordPress Pixeline's Email Protector Plugin <= 1.3.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-64264MEDIUMWordPress Popup addon for Ninja Forms plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67342MEDIUMRuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protecteEPSS 0.2%CVE-2026-61575MEDIUMAVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titlesEPSS 0.2%CVE-2025-58631MEDIUMWordPress IssueM Plugin <= 2.9.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-2736MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in Alkacon's OpenCmsEPSS 0.2%CVE-2026-75063MEDIUMIBM Planning Analytics Local is affected by security vulnerabilitiesEPSS 0.2%CVE-2025-62982MEDIUMWordPress Dynamic User Directory plugin <= 2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-36135MEDIUMIBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable to Cross-Site ScriptingEPSS 0.2%