Weaknesses of type CWE-79

29,998 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-22753HIGHWordPress turboSMTP Plugin <= 4.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-86301MEDIUMcode-projects Hospital Information System Patient Management editPatient.php cross site scriptingEPSS 0.3%CVE-2026-90564MEDIUMquequnlong shiyi-blog chat sendMsg Endpoint index.vue SysChatMsgMapper.getChatMsgList cross site scriptingEPSS 0.3%CVE-2025-22317HIGHWordPress Gallery Images Ape plugin <= 2.2.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22754HIGHWordPress Amber Plugin <=1.4.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-6415MEDIUMIngenico Estate Manager New Widget cross site scriptingEPSS 0.3%CVE-2025-11125MEDIUMlangleyfcu Online Banking System Error Message connection_error.php cross site scriptingEPSS 0.3%CVE-2026-15678MEDIUMcode-projects Online Job Portal DetailJob.php cross site scriptingEPSS 0.3%CVE-2026-82482MEDIUMcoppermine-gallery Coppermine Photo Gallery edit_profile Endpoint profile.php cross site scriptingEPSS 0.3%CVE-2026-13558MEDIUMCodeAstro Complaint Management System Report addreport cross site scriptingEPSS 0.3%CVE-2023-6744MEDIUMDivi <= 4.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2026-16156MEDIUMSourceCodester Class and Exam Timetabling System forexam.php cross site scriptingEPSS 0.3%CVE-2024-29796MEDIUMWordPress Hot Random Image plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-8380MEDIUMCampcodes Online Hotel Reservation System add_query_account.php cross site scriptingEPSS 0.3%CVE-2024-11723MEDIUMkvCORE IDX <= 2.3.35 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-5513MEDIUMquequnlong shiyi-blog add cross site scriptingEPSS 0.3%CVE-2024-30426MEDIUMWordPress Hash Elements plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-34462MEDIUMAlinto SOGo through 5.10.0 allows XSS during attachment preview.EPSS 0.3%CVE-2024-2787MEDIUMHappy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title HTML TagEPSS 0.3%CVE-2026-93977MEDIUMcode-projects Assessment Management add-single-mark.php cross site scriptingEPSS 0.3%