Weaknesses of type CWE-79

30,284 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-7408MEDIUMSourceCodester Zoo Management System animal_form_template.php cross site scriptingEPSS 0.3%CVE-2024-38953MEDIUMphpok 6.4.003 contains a Cross Site Scripting (XSS) vulnerability in the ok_f() method under the framework/api/upload_control.php file.EPSS 0.3%CVE-2024-51668MEDIUMWordPress MyCurator Content Curation plugin <= 3.78 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-2078MEDIUMCross-Site Scripting vulnerability in HelpDeskZEPSS 0.3%CVE-2024-53786MEDIUMWordPress Cowidgets – Elementor Addons plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-4667MEDIUMSimply Schedule Appointments <= 1.6.8.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple ShortcodesEPSS 0.3%CVE-2024-28983HIGHHitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')EPSS 0.3%CVE-2026-7052HIGHHT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting via File Upload FieldEPSS 0.3%CVE-2025-63708MEDIUMCross-Site Scripting (XSS) vulnerability exists in SourceCodester AI Font Matcher (nid=18425, 2025-10-10) that allows remote attackers to exEPSS 0.3%CVE-2024-2211MEDIUMCross-Site Scripting vulnerability in Gophish Admin PanelEPSS 0.3%CVE-2025-1571MEDIUMExclusive Addons for Elementor <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Image Comparison WidgetsEPSS 0.3%CVE-2025-57540MEDIUMA stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox EPSS 0.3%CVE-2024-6261MEDIUMImage Photo Gallery Final Tiles Grid <= 3.6.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-7857MEDIUMPHPGurukul Apartment Visitors Management System HTTP POST Request bwdates-passreports-details.php cross site scriptingEPSS 0.3%CVE-2024-31159MEDIUMASUS Download Master - Reflected XSSEPSS 0.3%CVE-2024-8328MEDIUMHWA JIUH DIGITAL TECHNOLOGY Easy test Online Learning and Testing Platform - Reflected XSSEPSS 0.3%CVE-2025-2477MEDIUMCryoKey <= 2.4 - Reflected Cross-Site Scripting via 'ckemail' ParameterEPSS 0.3%CVE-2026-5090MEDIUMTemplate::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injectedEPSS 0.3%CVE-2025-57539MEDIUMA stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVEPSS 0.3%CVE-2024-37156MEDIUMTokenController formName not sanitized in hidden inputEPSS 0.3%