Weaknesses of type CWE-79

30,218 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-12166MEDIUMShortcodes Blocks Creator Ultimate <= 2.2.0 - Reflected Cross-Site Scripting via 'page'EPSS 0.3%CVE-2025-28882HIGHWordPress Omnify plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-3652HIGHARForms <= 7.1.3 - Unauthenticated Stored Cross-Site Scripting via 'value' ParameterEPSS 0.3%CVE-2026-55793MEDIUMCraft CMS: Stored XSS via Structure entry title in table viewEPSS 0.3%CVE-2026-97711LOWSerialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodiesEPSS 0.3%CVE-2025-28877HIGHWordPress Key4ce osTicket Bridge plugin <= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-27269HIGHWordPress .htaccess Login block Plugin <= 0.9a - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-50578MEDIUMIn JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards pageEPSS 0.3%CVE-2025-28928HIGHWordPress Are you robot google recaptcha for Wordpress plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-1838MEDIUMHostel <= 1.1.6 - Reflected Cross-Site Scripting via 'shortcode_id' ParameterEPSS 0.3%CVE-2025-53608MEDIUMAn Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet ForEPSS 0.3%CVE-2025-5842MEDIUMModern Design Library <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class ParameterEPSS 0.3%CVE-2025-28869HIGHWordPress NextGEN Gallery Voting plugin <= 2.7.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-25648HIGHTraccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File UploadEPSS 0.3%CVE-2025-3706MEDIUM104 Corporation eHRMS - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2026-44549HIGHOpen WebUI: Stored XSS in excel file previewEPSS 0.3%CVE-2025-15591MEDIUMCross-Site Scripting (XSS) vulnerability identified in OpenText™ Content ManagementEPSS 0.3%CVE-2025-2482MEDIUMGotcha | Gesture-based Captcha <= 1.0.0 - Reflected Cross-Site Scripting via menu ParameterEPSS 0.3%CVE-2024-3946MEDIUMWP To Do <= 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting via SettingsEPSS 0.3%CVE-2026-16649HIGHGravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field ValueEPSS 0.3%