Weaknesses of type CWE-79

30,149 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-9718MEDIUMO2OA Personal Profile process cross site scriptingEPSS 0.3%CVE-2025-8539MEDIUMPortabilis i-Educar public_distrito_cad.php cross site scriptingEPSS 0.3%CVE-2025-9736MEDIUMO2OA Personal Profile statement cross site scriptingEPSS 0.3%CVE-2024-6262MEDIUMPortfolio Gallery – Image Gallery Plugin <= 1.6.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-9734MEDIUMO2OA Personal Profile stat cross site scriptingEPSS 0.3%CVE-2024-10223MEDIUMHT Team Member <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via htteamember ShortcodeEPSS 0.3%CVE-2024-32453MEDIUMWordPress POEditor plugin <= 0.9.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-41681MEDIUMPersistent Cross-Site Scripting via POST Requests Due to Improper Neutralization of InputEPSS 0.3%CVE-2026-12114MEDIUMTeam Members <= 8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_css' ParameterEPSS 0.3%CVE-2024-54046MEDIUMAdobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.3%CVE-2025-5661MEDIUMcode-projects Traffic Offense Reporting System Setting save-settings.php cross site scriptingEPSS 0.3%CVE-2024-43025MEDIUMAn HTML injection vulnerability in RWS MultiTrans v7.0.23324.2 and earlier allows attackers to alter the HTML-layout and possibly execute a EPSS 0.3%CVE-2026-15324MEDIUMSysBasics Customize My Account for WooCommerce <= 4.4.14 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'row_type' ParameterEPSS 0.3%CVE-2023-5118MEDIUMStored cross-site scripting vulnerability in Kofax Capture softwareEPSS 0.3%CVE-2021-26087MEDIUMAn improper neutralization of input during web page generation in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, EPSS 0.3%CVE-2024-32584MEDIUMWordPress TeraWallet plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-0977MEDIUMTimeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline) <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-12042MEDIUMWP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' ParameterEPSS 0.3%CVE-2024-11993MEDIUMReflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allowsEPSS 0.3%CVE-2024-20530MEDIUMCisco Identity Services Engine Reflected Cross-Site Scripting VulnerabilityEPSS 0.3%