Weaknesses of type CWE-79

30,260 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-39735MEDIUMIBM Datacap Navigator cross-site scriptingEPSS 0.3%CVE-2024-49647HIGHWordPress Simple Custom Admin plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-113499HIGHLiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS RewritingEPSS 0.3%CVE-2025-29710MEDIUMSourceCodester Company Website CMS 1.0 is vulnerable to Cross Site Scripting (XSS) via /dashboard/Services.EPSS 0.3%CVE-2024-51699HIGHWordPress Buooy Sticky Header plugin <= 0.5.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-27245CRITICALAdobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.3%CVE-2025-23026MEDIUMHTML templates containing Javascript template strings are subject to XSS in jteEPSS 0.3%CVE-2024-5058MEDIUMWordPress Typing Text plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-49650HIGHWordPress BuddyPress Greeting Message plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-2405HIGHXSS in Verisay Communication's TitarusEPSS 0.3%CVE-2025-29015MEDIUMCode Astro Internet Banking System 2.0.0 is vulnerable to Cross Site Scripting (XSS) via the name parameter in /admin/pages_account.php.EPSS 0.3%CVE-2026-27243CRITICALAdobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 0.3%CVE-2026-3041MEDIUMxingfuggz BaykeShop Article Sidebar custom.html cross site scriptingEPSS 0.3%CVE-2024-5867MEDIUMDelicate <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button ShortcodeEPSS 0.3%CVE-2025-10235MEDIUMScada-LTS Reports reports.shtm cross site scriptingEPSS 0.3%CVE-2025-10758MEDIUMhtmly Custom Field post cross site scriptingEPSS 0.3%CVE-2025-53231HIGHWordPress Easy Taxonomy Images plugin <= 1.0.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-50807MEDIUMTrippo Responsive Filemanager 9.14.0 is vulnerable to Cross Site Scripting (XSS) via file upload using the svg and pdf extensions.EPSS 0.3%CVE-2025-53228HIGHWordPress bbpress Simple Advert Units Plugin <= 0.41 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-112951MEDIUMApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefixEPSS 0.3%