Weaknesses of type CWE-79

30,295 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-28937MEDIUMWordPress Lava Ajax Search plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-46187MEDIUMIBM InfoSphere Master Data Management cross-site scriptingEPSS 0.3%CVE-2026-45014MEDIUMApostrophe Vulnerable to Stored Cross-Site Scripting via Unsanitized User Display Name in Draft Version TooltipEPSS 0.3%CVE-2025-68723CRITICALAxigen Mail Server before 10.5.57 contains multiple stored Cross-Site Scripting (XSS) vulnerabilities in the WebAdmin interface. Three instaEPSS 0.3%CVE-2026-1044MEDIUMTennis Court Bookings <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings and Calendar ParametersEPSS 0.3%CVE-2026-85159MEDIUMAVideo Reflected XSS via cancelUri in userLogin.phpEPSS 0.3%CVE-2025-28914MEDIUMWordPress wordpress login form to anywhere plugin <= 0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-3510MEDIUMtagDiv Composer <= 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple ShortcodesEPSS 0.3%CVE-2024-4734MEDIUMImport and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-18843MEDIUMBeaver Builder Plugin (Pro Version) <= 2.11.0.1 - Reflected Cross-Site Scripting via 'no_results_message' node_preview ParameterEPSS 0.3%CVE-2025-27303MEDIUMWordPress Contact Form 7 Star Rating plugin <= 1.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-3858MEDIUMFormality <= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via align ParameterEPSS 0.3%CVE-2024-9571MEDIUMCross-Site Scripting vulnerability in SOPlanningEPSS 0.3%CVE-2024-13508MEDIUMBooking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale ParameterEPSS 0.3%CVE-2024-28276MEDIUMSourcecodester School Task Manager 1.0 is vulnerable to Cross Site Scripting (XSS) via add-task.php?task_name=.EPSS 0.3%CVE-2025-59412MEDIUMCubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and DefacementEPSS 0.3%CVE-2024-44717MEDIUMA cross-site scripting (XSS) vulnerability in DedeBIZ v6.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadEPSS 0.3%CVE-2025-23581MEDIUMWordPress Demo User DZS plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-2893MEDIUMGutenverse <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via countdown BlockEPSS 0.3%CVE-2024-52356MEDIUMWordPress The Pack Elementor addons plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%