Weaknesses of type CWE-79

29,350 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-48883MEDIUMChrome PHP is missing encoding in `CssSelector`EPSS 0.5%CVE-2025-3822MEDIUMSourceCodester Web-based Pharmacy Product Management System changepassword.php cross site scriptingEPSS 0.5%CVE-2023-25571MEDIUMBackstage has XSS Vulnerability in Software CatalogEPSS 0.5%CVE-2026-54498HIGHview_component: around_render HTML-Safety BypassEPSS 0.5%CVE-2026-39933MEDIUMMultiple XSS vulnerabilities in GlobalWatchlistEPSS 0.5%CVE-2026-39935MEDIUMXSS-via-i18n in localised wiki namesEPSS 0.5%CVE-2024-3665MEDIUMRank Math SEO with AI SEO Tools <= 1.0.216 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleWrapper'EPSS 0.5%CVE-2024-4780MEDIUMImage Hover Effects – Elementor Addon <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via eihe_link ParameterEPSS 0.5%CVE-2024-6939MEDIUMXinhu RockOA tpl_upload.html okla cross site scriptingEPSS 0.5%CVE-2026-28355LOW"PWA" Canarytoken Vulnerable to Stored Self Cross-Site ScriptingEPSS 0.5%CVE-2022-36311—Airspan AirVelocity 1500 prior to software version 15.18.00.2511 is vulnerable to injection leading to XSS in the SNMP community field in thEPSS 0.5%CVE-2026-39936MEDIUMStored XSS in Score due to usage of non-reserved data attributesEPSS 0.5%CVE-2024-29193MEDIUMGHSL-2023-207 gotortc DOM-based Cross-site Scripting vulnerabilityEPSS 0.5%CVE-2026-72751MEDIUMStored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP ContentEPSS 0.5%CVE-2024-7343MEDIUMBaidu UEditor cross site scriptingEPSS 0.5%CVE-2026-15810HIGHCross-Site Scripting (XSS) in Looker allows Admin Account TakeoverEPSS 0.5%CVE-2024-7976MEDIUMInappropriate implementation in FedCM in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a craftedEPSS 0.5%CVE-2026-54216MEDIUMTeamDavid: Reflected Cross Site Scripting (XSS) via the 'EntryInfo' parameterEPSS 0.5%CVE-2024-3554MEDIUMAll in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2024-4327LOWApryse WebViewer PDF Document cross site scriptingEPSS 0.5%