Weaknesses of type CWE-79

30,190 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-24544HIGHWordPress Bitcoin and Altcoin Wallets plugin <= 6.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-14320CRITICALXSS in Tegsoft's Online Support ApplicationEPSS 0.3%CVE-2023-40262MEDIUMAn issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. It allows unauthenticated Stored Cross-Site ScriptEPSS 0.3%CVE-2023-37933HIGHAn improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiADC GUI version 7.4.0EPSS 0.3%CVE-2024-47389HIGHWordPress NEX-Forms plugin <= 8.7.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-41706HIGHA stored XSS issue was discovered in Archer Platform 6 before version 2024.06. A remote authenticated malicious Archer user could potentiallEPSS 0.3%CVE-2024-2634MEDIUMMultiple vulnerabilities on Meta4 HR from CegidEPSS 0.3%CVE-2024-37461HIGHWordPress IdeaPush plugin <= 8.65 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2015-20118MEDIUMRealtyScript 4.0.2 Stored Cross-Site Scripting via location_name ParameterEPSS 0.3%CVE-2025-57959MEDIUMWordPress Slightly troublesome permalink Plugin <= 1.2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-28793MEDIUMIBM Engineering Workflow Management cross-site scriptingEPSS 0.3%CVE-2024-47638HIGHWordPress Online Booking & Scheduling Calendar for WordPress plugin <= 4.4.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-73295MEDIUMMaterial for MkDocs: DOM XSS in search suggestions via query parameterEPSS 0.3%CVE-2025-57952MEDIUMWordPress Maps for WP Plugin <= 1.2.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2023-3937MEDIUMCross site scripting vulnerabilities in Snow License ManagerEPSS 0.3%CVE-2026-85484MEDIUMHTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escapingEPSS 0.3%CVE-2026-41683HIGHHTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language headerEPSS 0.3%CVE-2025-52344MEDIUMMultiple Cross Site Scripting (XSS) vulnerabilities in input fields in Explorance Blue 8.1.2 allows attackers to inject arbitrary JavaScriptEPSS 0.3%CVE-2025-7143MEDIUMSourceCodester Best Salon Management System Update Tax Page edit-tax.php cross site scriptingEPSS 0.3%CVE-2024-37459HIGHWordPress PayPlus Payment Gateway plugin <= 6.6.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%