Weaknesses of type CWE-79

30,295 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-55072MEDIUMStored cross-site scripting (XSS) vulnerability in desknet's NEO V2.0R1.0 to V9.0R2.0 allow execution of arbitrary JavaScript in a user’s weEPSS 0.3%CVE-2025-63785MEDIUMA DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32. This vulnerabilEPSS 0.3%CVE-2026-1011MEDIUMStored Cross-Site Scripting in Altium Live Support Center Comment EndpointEPSS 0.3%CVE-2025-1455MEDIUMRoyal Elementor Addons and Templates <= 1.7.1012 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2020-36844MEDIUMThe KnowBe4 Security Awareness Training application before 2020-01-10 allows reflected XSS. The response has a SCRIPT element that sets windEPSS 0.3%CVE-2025-3077MEDIUMBetheme <= 28.0.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-1266MEDIUMPostalicious <= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin SettingsEPSS 0.3%CVE-2025-9940MEDIUMCodeAstro Real Estate Management System feature.php cross site scriptingEPSS 0.3%CVE-2025-10632MEDIUMitsourcecode Online Petshop Management System Admin Dashboard availableframe.php cross site scriptingEPSS 0.3%CVE-2025-5753MEDIUMValuation Calculator <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via link ParameterEPSS 0.3%CVE-2025-1456MEDIUMRoyal Elementor Addons and Templates <= 1.7.1012 - Authenticated DOM-Based (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-63169MEDIUMOmnispace Agora Project < 26.10.0 Stored XSS via Messenger IframeEPSS 0.3%CVE-2025-63211MEDIUMStored cross-site scripting vulnerability in bridgetech VBC Server & Element Manager, firmware versions 6.5.0-9 thru 6.5.0-10, allows attackEPSS 0.3%CVE-2025-54760MEDIUMStored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s weEPSS 0.3%CVE-2026-25932HIGHGLPI has Stored XSS in Supplier 'Website' fieldEPSS 0.3%CVE-2024-47486LOWThere is an XSS vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could inject scripts into certain pages by EPSS 0.3%CVE-2026-7174MEDIUMMultiple vulnerabilities in Entradium by CrocanticketsEPSS 0.3%CVE-2026-34907MEDIUMReflected Cross-Site Scripting (XSS) in Wirtualna UczelniaEPSS 0.3%CVE-2026-1809MEDIUMHTML Shortcodes <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2025-10354MEDIUMReflected Cross-Site Scripting (XSS) in Semantic MediaWikiEPSS 0.3%