Weaknesses of type CWE-79

30,269 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-9488MEDIUMRedux Framework <= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data ParameterEPSS 0.3%CVE-2025-32116HIGHWordPress QR Master plugin <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5964MEDIUMZenon Lite <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button ShortcodeEPSS 0.3%CVE-2026-40508MEDIUMOpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import HandlerEPSS 0.3%CVE-2023-50167MEDIUMPega Platform from 7.1.7 to 23.1.1 is affected by an XSS issue with editing/rendering user html content.EPSS 0.3%CVE-2026-84701MEDIUMNocoBase Rich Text Field Stored Cross-Site Scripting via APIEPSS 0.3%CVE-2024-21738MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Application Server and ABAP PlatformEPSS 0.3%CVE-2026-8391MEDIUMOther issue in the JavaScript Engine componentEPSS 0.3%CVE-2024-37114MEDIUMWordPress My Favorites plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-22867HIGHLaSuite Doc affected by Stored XSS via Interlinking BlockEPSS 0.3%CVE-2026-83801MEDIUMNautobot: Stored cross-site scripting (XSS) in object create/edit form help textEPSS 0.3%CVE-2026-89268MEDIUMQloApps through 1.7.0 Reflected XSS via List Filter ParametersEPSS 0.3%CVE-2025-31889MEDIUMWordPress Extensions for Elementor plugin <= 2.0.40 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-9318MEDIUMtablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset TitleEPSS 0.3%CVE-2025-30925MEDIUMWordPress The Pack Elementor addons plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2022-30360MEDIUMOvalEdge 5.2.8.0 and earlier is affected by multiple Stored XSS (AKA Persistent or Type II) vulnerabilities via a POST request to /profile/uEPSS 0.3%CVE-2026-82396MEDIUMSulu: Stored XSS via media download inline-disposition overrideEPSS 0.3%CVE-2023-6487MEDIUMLuckyWP Table of Contents <= 2.1.5 - Authenticated (Administrator+) Cross-Site ScriptingEPSS 0.3%CVE-2025-30920MEDIUMWordPress WP Posts Carousel plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-2600MEDIUMElementsKit Elementor Addons and Templates <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab WidgetEPSS 0.3%