Weaknesses of type CWE-79

30,604 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-62758MEDIUMWordPress Funnelforms Free plugin <= 3.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-91829HIGHSubscribe to Comments < 2.3.3 - Reflected XSS via 'ref' ParameterEPSS 0.2%CVE-2026-29828MEDIUMDooTask v1.6.27 has a Cross-Site Scripting (XSS) vulnerability in the /manage/project/<id> page via the input field projectDesc.EPSS 0.2%CVE-2026-7814MEDIUMpgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain VisualizerEPSS 0.2%CVE-2026-101890MEDIUMPrime Mover < 2.2.1 Stored XSS via Package MetadataEPSS 0.2%CVE-2026-2837MEDIUMRicerca – advanced search <= 1.1.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's SettingsEPSS 0.2%CVE-2026-47694MEDIUMWWBN AVideo: Stored XSS via unescaped Gallery category descriptionEPSS 0.2%CVE-2026-31879MEDIUMFrappe Workspace modification and stored XSS due to improper resource ownership checksEPSS 0.2%CVE-2026-32095MEDIUMPlunk has Stored Cross-Site Scripting (XSS) via SVG File UploadEPSS 0.2%CVE-2025-27895MEDIUMDB2 Recovery Expert for Linux, UNIX and Windows Cross-Site ScriptingEPSS 0.2%CVE-2026-55422MEDIUMconda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboardEPSS 0.2%CVE-2026-2687MEDIUMReading progressbar < 1.3.1 - Admin+ Stored XSSEPSS 0.2%CVE-2026-39508MEDIUMWordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.7.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-36750HIGHStored cross site scripting (XSS) vulnerability in Growatt ShineLan-XEPSS 0.2%CVE-2026-31914MEDIUMWordPress WP Courses LMS plugin <= 3.2.26 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-27896MEDIUMIBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site ScriptingEPSS 0.2%CVE-2026-39483MEDIUMWordPress VK All in One Expansion Unit plugin <= 9.113.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-66843MEDIUMgrav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. An authenticated low-pEPSS 0.2%CVE-2026-25355MEDIUMWordPress Sanzo theme < 2.4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-36728MEDIUMA markdown based cross-site scripting (XSS) vulnerability in the AI assistant chat function of FastapiAdmin v2.2.0 allows attackers to execuEPSS 0.2%