Weaknesses of type CWE-79

30,266 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-53930MEDIUMWeGIA vulnerable to Stored Cross-Site Scripting (XSS) via endpoint 'adicionar_especie.php' parameter 'especie'EPSS 0.3%CVE-2025-27099MEDIUMTuleap allows XSS via the tracker names used in the semantic timeframe deletion messageEPSS 0.3%CVE-2024-41584MEDIUMDrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to reflected XSS by authenticated users, caused by missing validation of the sFormAEPSS 0.3%CVE-2025-52762HIGHWordPress flexo-posts-manager Plugin <= 1.0001 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-4970MEDIUMBSK PDF Manager <= 3.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-52418HIGHWordPress Gameplan theme <= 1.5.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-54540MEDIUMReflected XSS in QuickCMSEPSS 0.3%CVE-2025-47666HIGHWordPress Image&Video FullScreen Background plugin <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-44115MEDIUMA vulnerability has been found in Cotonti Siena v0.9.25. Affected by this vulnerability is the file /admin.php?m=config&n=edit&o=core&p=titlEPSS 0.3%CVE-2025-3715MEDIUMBold Page Builder <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' ParameterEPSS 0.3%CVE-2024-47063MEDIUMComputer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpointEPSS 0.3%CVE-2026-26378MEDIUMCross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via file upload function in IEPSS 0.3%CVE-2026-65912MEDIUMDOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTREPSS 0.3%CVE-2026-42052MEDIUMbeets is Vulnerable to XSSEPSS 0.3%CVE-2024-41583MEDIUMDrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to stored Cross Site Scripting (XSS) by authenticated users due to poor sanitizatioEPSS 0.3%CVE-2025-4944MEDIUMLA-Studio Element Kit for Elementor <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Compare and Google Maps WidgetsEPSS 0.3%CVE-2026-25488MEDIUMCraft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege EscalationEPSS 0.3%CVE-2025-6127MEDIUMPHPGurukul Nipah Virus Testing Management System search-report.php cross site scriptingEPSS 0.3%CVE-2025-53933MEDIUMWeGIA vulnerable to Stored Cross-Site Scripting via endpoint 'adicionar_enfermidade.php' parameter 'nome'EPSS 0.3%CVE-2025-67495HIGHZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 LoginEPSS 0.3%