Weaknesses of type CWE-79

30,295 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-0545MEDIUMXSS in Tekrom Technology's T-Soft E-CommerceEPSS 0.3%CVE-2026-41250MEDIUMXSS in taiga-frontEPSS 0.3%CVE-2025-3020MEDIUMWiesemann & Theis: Multiple W&T Products are vulnerable to cross-site-scriptingEPSS 0.3%CVE-2025-60312MEDIUMSourcecodester Markdown to HTML Converter v1.0 is vulnerable to a Cross-Site Scripting (XSS) in the "Markdown Input" field, allowing a remotEPSS 0.3%CVE-2026-1053MEDIUMIvory Search <= 5.5.13 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_gcse' and 'nothing_found_text' ParametersEPSS 0.3%CVE-2020-36993MEDIUMLimeSurvey <= 4.3.10 - 'Survey Menu' Persistent Cross-Site ScriptingEPSS 0.3%CVE-2026-111059MEDIUMMercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTMLEPSS 0.3%CVE-2026-55409HIGHFilament: Disabled RichEditor field state can be used for XSSEPSS 0.3%CVE-2026-85235HIGHForminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea FieldEPSS 0.3%CVE-2024-45528MEDIUMCodeAstro MembershipM-PHP (aka Membership Management System in PHP) 1.0 allows add_members.php fullname stored XSS.EPSS 0.3%CVE-2025-46478HIGHWordPress Dropdown Content plugin <= 1.0.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2019-25280MEDIUMYahei-PHP Prober 0.4.7 Remote HTML Injection via Speed ParameterEPSS 0.3%CVE-2024-11814MEDIUMAdditional Custom Order Status for WooCommerce <= 1.6.0 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2025-22580MEDIUMWordPress Biltorvet Dealer Tools plugin <= 1.0.22 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-22577MEDIUMWordPress Able Player plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-57237MEDIUMProlink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to Cross Site Scripting (XSS) in the /reqproc/proc_get endpoint. The vulnerabilEPSS 0.3%CVE-2025-60950MEDIUMAn arbitrary file upload vulnerability in the Data Preparation function of AIxBlock commit f60975 allows attackers to execute arbitrary codeEPSS 0.3%CVE-2026-4616MEDIUMbolo-blog Article Title article cross site scriptingEPSS 0.3%CVE-2026-4952MEDIUMStored Cross-Site Scripting in OrderAdministration Portal (AuftragsManager) via Business Reference in VertiGIS WebOrderSystemEPSS 0.3%CVE-2026-34716MEDIUMAVideo: DOM XSS via Unsanitized Display Name in WebSocket Call NotificationEPSS 0.3%