Weaknesses of type CWE-79

30,269 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-61183MEDIUMCross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of EPSS 0.3%CVE-2025-9978MEDIUMJeg Elementor Kit < 2.7.0 - Author+ Stored XSSEPSS 0.3%CVE-2025-23451HIGHWordPress Awesome Twitter Feeds plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-31626HIGHWordPress Support Helpdesk Ticket System Lite plugin <= 4.5.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-9595MEDIUMTablePress <= 2.4.2 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-9856MEDIUMPopup Builder – Create highly converting, mobile friendly marketing popups. <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-27020MEDIUMPhotobooth has a XSS vulnerability in user inputEPSS 0.3%CVE-2025-20049HIGHDario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Cross-site ScriptingEPSS 0.3%CVE-2026-3003HIGHVagaro Booking Widget <= 0.3 - Unauthenticated Stored Cross-Site Scripting via 'vagaro_code'EPSS 0.3%CVE-2024-12525MEDIUMEasy MLS Listings Import <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-108722LOWopen-computer-use through commit 610bac8 Stored XSS via log.html Session LogEPSS 0.3%CVE-2025-0757MEDIUMHitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.3%CVE-2024-36599MEDIUMA cross-site scripting (XSS) vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloaEPSS 0.3%CVE-2025-24909MEDIUMHitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.3%CVE-2025-23433HIGHWordPress vcOS plugin <=1.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-25119HIGHWordPress Woocommerce osCommerce Sync plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-32118MEDIUMOpenEMR has Stored XSS in Graphical Pain Map legend via unescaped annotation textEPSS 0.3%CVE-2025-22578MEDIUMWordPress WP Cookie plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5668MEDIUMLightbox & Modal Popup WordPress Plugin – FooBox <= 2.7.28 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data AttributesEPSS 0.3%CVE-2025-23450HIGHWordPress AW WooCommerce Kode Pembayaran plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%