Weaknesses of type CWE-79

30,150 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-8153MEDIUMCross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.1EPSS 0.3%CVE-2024-3230MEDIUMDownload Attachments <= 1.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-6897MEDIUMaThemes Starter Sites <= 1.0.53 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2025-28254MEDIUMCross Site Scripting vulnerability in Leantime v3.2.1 and before allows an authenticated attacker to execute arbitrary code and obtain sensiEPSS 0.3%CVE-2026-21944MEDIUMVulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality ManageEPSS 0.3%CVE-2026-22256HIGHSalvo is vulnerable to reflected XSS in the list_html functionEPSS 0.3%CVE-2024-29906MEDIUMWordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-29774MEDIUMDreamer CMS 3.0.1 is vulnerable to stored Cross Site Scripting (XSS).EPSS 0.3%CVE-2024-52483HIGHWordPress LeanPress plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-4988HIGHStored Cross-site Scripting (XSS) vulnerability affecting Results Analytics in Multidisciplinary Optimization Engineer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2024-2958MEDIUMSVS Pricing Tables <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-4983HIGHStored Cross-site Scripting (XSS) vulnerability affecting City Referential in City Referential Manager on Release 3DEXPERIENCE R2025xEPSS 0.3%CVE-2024-22289HIGHWordPress Post views Stats plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-4992HIGHStored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in Service Process Engineer from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2025xEPSS 0.3%CVE-2025-4990HIGHStored Cross-site Scripting (XSS) vulnerability affecting Change Governance in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025xEPSS 0.3%CVE-2024-32468MEDIUMImproper neutralization of input during web page generation ("Cross-site Scripting") in deno_doc HTML generatorEPSS 0.3%CVE-2025-48447HIGHLightgallery - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-069EPSS 0.3%CVE-2024-8324MEDIUMXO Slider <= 3.8.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-59948MEDIUMFreshRSS is vulnerable to XSS due to lack of CSP on HTML query pageEPSS 0.3%CVE-2025-4985HIGHStored Cross-site Scripting (XSS) vulnerability affecting Risk Management in Project Portfolio Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025xEPSS 0.3%