Weaknesses of type CWE-79

30,295 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-3858MEDIUMFormality <= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via align ParameterEPSS 0.3%CVE-2024-52356MEDIUMWordPress The Pack Elementor addons plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-18843MEDIUMBeaver Builder Plugin (Pro Version) <= 2.11.0.1 - Reflected Cross-Site Scripting via 'no_results_message' node_preview ParameterEPSS 0.3%CVE-2025-28914MEDIUMWordPress wordpress login form to anywhere plugin <= 0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-27303MEDIUMWordPress Contact Form 7 Star Rating plugin <= 1.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-9798HIGHStored XSS in Netcad Software's NetigmaEPSS 0.3%CVE-2026-44759MEDIUMCross Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise PortalEPSS 0.3%CVE-2025-28937MEDIUMWordPress Lava Ajax Search plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-55492MEDIUMWinmail Server 4.4 is vulnerable to f_user=%22%3E%3Csvg%20onload Cross Site Scripting (XSS).EPSS 0.3%CVE-2025-2893MEDIUMGutenverse <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via countdown BlockEPSS 0.3%CVE-2024-6742MEDIUMAguardNet Space Management System - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2026-97336HIGHCMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field TypeEPSS 0.3%CVE-2025-55072MEDIUMStored cross-site scripting (XSS) vulnerability in desknet's NEO V2.0R1.0 to V9.0R2.0 allow execution of arbitrary JavaScript in a user’s weEPSS 0.3%CVE-2025-9940MEDIUMCodeAstro Real Estate Management System feature.php cross site scriptingEPSS 0.3%CVE-2026-1011MEDIUMStored Cross-Site Scripting in Altium Live Support Center Comment EndpointEPSS 0.3%CVE-2024-11254MEDIUMAMP for WP – Accelerated Mobile Pages <= 1.1.1 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2026-102576MEDIUMQuay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin pageEPSS 0.3%CVE-2025-27084MEDIUMReflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal (CP) of an AOS-10 GW and AOS-8 Controller/Mobility Conductor Web-based Management InterfaceEPSS 0.3%CVE-2025-3077MEDIUMBetheme <= 28.0.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-1455MEDIUMRoyal Elementor Addons and Templates <= 1.7.1012 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%