Weaknesses of type CWE-79

29,620 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-58064LOWCKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard packageEPSS 0.4%CVE-2026-1721MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in AI Playground siteEPSS 0.4%CVE-2025-3570MEDIUMJamesZBL/code-projects db-hospital-drug ContentController.java save cross site scriptingEPSS 0.4%CVE-2024-12024HIGHEventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type NameEPSS 0.4%CVE-2026-40262HIGHNote Mark has Stored XSS via Unrestricted Asset UploadEPSS 0.4%CVE-2026-45115HIGHMyBB: Buddy/ignore list username XSSEPSS 0.4%CVE-2024-9206MEDIUMMAS Companies For WP Job Manager <= 1.0.13 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-7134HIGHLiquidPoll <= 3.3.78 - Unauthenticated Stored Cross-Site Scripting via form_data ParameterEPSS 0.4%CVE-2026-75933HIGHJet Admin Stored XSSEPSS 0.4%CVE-2026-95657MEDIUMdgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scriptingEPSS 0.4%CVE-2025-22624MEDIUMFooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry and Carousel 2.4.29 - Reflected cross-site scripting (XSS)EPSS 0.4%CVE-2022-41432MEDIUMEyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /module/reEPSS 0.4%CVE-2024-12089HIGHStored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.4%CVE-2024-9350MEDIUMDPD Baltic Shipping <= 1.2.83 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-28298MEDIUMSolarWinds Observability Self-Hosted Stored Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2023-35882MEDIUMWordPress Super Socializer Plugin <= 7.13.52 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2022-47968MEDIUMHeimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. The storeEPSS 0.4%CVE-2020-3420MEDIUMCisco Unified Communications Manager Stored Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2024-9024MEDIUMMaterial Design Icons <= 0.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via mdi-icon ShortcodeEPSS 0.4%CVE-2023-47813MEDIUMWordPress Better RSS Widget Plugin <= 2.8.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%