diff --git a/backend/server.js b/backend/server.js
index d252641..9aeb625 100644
--- a/backend/server.js
+++ b/backend/server.js
@@ -25,6 +25,12 @@ app.get('/', (req, res) => {
     `);
 });
 
+app.get('/api/search', (req, res) => {
+    const termo = req.query.q || '';
+    // Vulnerabilidade Crítica: XSS Refletido
+    res.send(`<html><body><h1>Resultados para: ${termo}</h1></body></html>`);
+});
+
 // Serve a pasta frontend
 app.use(express.static(path.join(__dirname, '../frontend'), { extensions: ['html'] }));