Weaknesses of type CWE-79

30,266 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-10141MEDIUMDigiseller <= 1.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-104847HIGHProseMirror: XSS vulnerability in prosemirror-view's paste handlingEPSS 0.3%CVE-2025-40647MEDIUMStored Cross-Site Scripting (XSS) vulnerability in Issabel productsEPSS 0.3%CVE-2024-50561MEDIUMA vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM EPSS 0.3%CVE-2023-48681LOWSelf cross-site scripting (XSS) vulnerability in storage nodes search field. The following products are affected: Acronis Cyber Protect 16 (EPSS 0.3%CVE-2024-56507MEDIUMReflected Cross-Site Scripting (XSS) Vulnerability in LinkAceEPSS 0.3%CVE-2026-1391MEDIUMVzaar Media Management <= 1.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']EPSS 0.3%CVE-2026-5698MEDIUMStored Cross-Site Scripting (XSS) vulnerability in SABBATIC applicationEPSS 0.3%CVE-2025-53929MEDIUMWeGIA vulnerable to Stored Cross-Site Scripting (XSS) via endpoint `adicionar_cor.php` parameter `cor`EPSS 0.3%CVE-2026-5699MEDIUMStored Cross-Site Scripting (XSS) vulnerability in SABBATIC applicationEPSS 0.3%CVE-2026-11959MEDIUMMultiple vulnerabilities in FacturaScriptsEPSS 0.3%CVE-2026-54070HIGHSiYuan: Stored XSS in Bazaar marketplace via package README event handlersEPSS 0.3%CVE-2025-0811HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%CVE-2025-7431MEDIUMKnowledge Base <= 2.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin SlugEPSS 0.3%CVE-2025-32123HIGHWordPress HTML5 Video Player with Playlist & Multiple Skins plugin <= 5.3.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-53931MEDIUMWeGIA vulnerable to Stored Cross-Site Scripting via endpoint `adicionar_raca.php` parameter `raca`EPSS 0.3%CVE-2025-66468HIGHAimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editorsEPSS 0.3%CVE-2025-48092HIGHWordPress Fix Multiple Redirects plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-5697MEDIUMStored Cross-Site Scripting (XSS) vulnerability in SABBATIC applicationEPSS 0.3%CVE-2026-42611HIGHGrav: Stored XSS via Tag InjectionEPSS 0.3%