Weaknesses of type CWE-79

30,269 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-46611MEDIUMCross Site Scripting vulnerability in ARTEC EMA Mail v6.92 allows an attacker to execute arbitrary code via a crafted script.EPSS 0.3%CVE-2025-2892MEDIUMAll in One SEO Pack <= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URLEPSS 0.3%CVE-2026-54701MEDIUMMarkdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in WebviewEPSS 0.3%CVE-2024-56358HIGHCross-site Scripting vulnerability through svg attachment previews in grist-coreEPSS 0.3%CVE-2026-25484MEDIUMCraft Commerce has Stored XSS in Product Type NameEPSS 0.3%CVE-2024-57772MEDIUMA cross-site scripting (XSS) vulnerability in the /bumph/getDraftListPage?type interface of JFinalOA before v2025.01.01 allows attackers to EPSS 0.3%CVE-2025-63499MEDIUMAlinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.EPSS 0.3%CVE-2025-6475MEDIUMSourceCodester Student Result Management System Manage Students Module manage_students cross site scriptingEPSS 0.3%CVE-2025-31409MEDIUMWordPress Bridge Core plugin < 3.3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-0724MEDIUMWPlyr Media Block <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via '_wplyr_accent_color' ParameterEPSS 0.3%CVE-2024-13902MEDIUMhuang-yk student-manage Edit a Student Information Page cross site scriptingEPSS 0.3%CVE-2023-51252MEDIUMPublicCMS 4.0 is vulnerable to Cross Site Scripting (XSS). Because files can be uploaded and online preview function is provided, pdf files EPSS 0.3%CVE-2025-8316MEDIUMCertifica WP <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via evento ParameterEPSS 0.3%CVE-2025-6125MEDIUMPHPGurukul Rail Pass Management System aboutus.php cross site scriptingEPSS 0.3%CVE-2026-100147HIGHFunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)EPSS 0.3%CVE-2025-53658MEDIUMJenkins Applitools Eyes Plugin 1.16.5 and earlier does not escape the Applitools URL on the build page, resulting in a stored cross-site scrEPSS 0.3%CVE-2026-115869MEDIUMThemify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater FieldEPSS 0.3%CVE-2025-7435MEDIUMLiveHelperChat lhc-php-resque Extension List list cross site scriptingEPSS 0.3%CVE-2024-11623MEDIUMStored XSS in authentikEPSS 0.3%CVE-2026-36748CRITICALRockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Site Scripting (XSS) via Social Media links in user profile.EPSS 0.3%