Weaknesses of type CWE-79

30,217 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-7872MEDIUMPortabilis i-Diario justificativas-de-falta cross site scriptingEPSS 0.3%CVE-2024-6703MEDIUMContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen FieldsEPSS 0.3%CVE-2026-29038MEDIUMchangedetection.io: Reflected XSS in RSS Tag Error ResponseEPSS 0.3%CVE-2024-32083MEDIUMWordPress Easy Logo plugin <= 1.9.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47097MEDIUMReflected Cross-Site Scripting in Follet School Solutions DestinyEPSS 0.3%CVE-2024-31931MEDIUMWordPress Save as Image plugin by Pdfcrowd plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-14911CRITICALImproper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to readEPSS 0.3%CVE-2025-24726MEDIUMWordPress Contact Form 7 Widget plugin <= 1.2.1 - Stored Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2022-40744MEDIUMIBM Aspera Faspex cross-site scriptingEPSS 0.3%CVE-2024-40604MEDIUMAn issue was discovered in the Nimbus skin for MediaWiki through 1.42.1. There is Stored XSS via MediaWiki:Nimbus-sidebar menu and submenu eEPSS 0.3%CVE-2025-2878MEDIUMKentico CMS Additional Database Installation Wizard install.aspx cross site scriptingEPSS 0.3%CVE-2024-38815MEDIUMVMware NSX contains a content spoofing vulnerability.  An unauthenticated malicious actor may be able to craft a URL and redirect a victim EPSS 0.3%CVE-2023-45186MEDIUMIBM Sterling B2B Integrator cross-site scriptingEPSS 0.3%CVE-2026-119761MEDIUMAxigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display NameEPSS 0.3%CVE-2024-32080MEDIUMWordPress Search Keyword Redirect plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-32831MEDIUMWordPress Accessibility Widget plugin <= 2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-33643MEDIUMWordPress Advanced Most Recent Posts Mod plugin <= 1.6.5.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-31361MEDIUMWordPress bunny.net plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-47714MEDIUMIBM Sterling File Gateway cross-site scriptingEPSS 0.3%CVE-2024-8708MEDIUMSourceCodester Best House Rental Management System categories.php cross site scriptingEPSS 0.3%