Weaknesses of type CWE-79

29,696 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2023-32580MEDIUMWordPress Password Protected Plugin <= 2.6.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2025-12510HIGHWidgets for Google Reviews <= 13.2.4 - Unauthenticated Stored Cross-Site Scripting via Google ReviewsEPSS 0.4%CVE-2026-91204MEDIUMApache Roller: Stored javascript: URI in HTML commentsEPSS 0.4%CVE-2026-94277MEDIUMStored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy NameEPSS 0.4%CVE-2023-32515MEDIUMWordPress Custom Field Suite Plugin <= 2.6.2.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-73158MEDIUMcti-transmute Saved Graph Configuration Allows Stored Cross-Site Scripting via svgIconEPSS 0.4%CVE-2025-40729MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in Customer Support SystemEPSS 0.4%CVE-2025-63307HIGHalexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). The application permits user-controlled upload, create, anEPSS 0.4%CVE-2025-12334MEDIUMcode-projects E-Commerce Website product_add.php cross site scriptingEPSS 0.4%CVE-2024-30558HIGHWordPress Add Shortcodes Actions And Filters plugin <= 2.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-10063MEDIUMitsourcecode POS Point of Sale System deferred_table.php cross site scriptingEPSS 0.4%CVE-2025-1830MEDIUMzj1983 zz Customer Information cross site scriptingEPSS 0.4%CVE-2023-46640MEDIUMWordPress Medialist Plugin <= 1.3.9 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-47817MEDIUMUnvalidated paragraph widget values can be used for Cross-site Scripting in lara-zeusEPSS 0.4%CVE-2026-69615LOWMicrosoft Office SharePoint Spoofing VulnerabilityEPSS 0.4%CVE-2024-30561HIGHWordPress Appointment Calendar plugin <= 2.9.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2023-25314MEDIUMCross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information EPSS 0.4%CVE-2023-36918MEDIUMCross-Site Scripting vulnerability in SAP Enable NowEPSS 0.4%CVE-2025-9773MEDIUMRemoteClinic edit.php cross site scriptingEPSS 0.4%CVE-2025-34399MEDIUMMailEnable < 10.54 Reflected XSS in AddressesCc Parameter of AddressBook.aspxEPSS 0.4%