Weaknesses of type CWE-79

30,295 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-41897MEDIUMMantisBT: Reflected XSS in Rendering Dynamic Custom Textarea FieldEPSS 0.3%CVE-2022-41611LOWPotential XSS on sidebar navigationEPSS 0.3%CVE-2025-23518HIGHWordPress GoogleMapper plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-30597MEDIUMWordPress IG Shortcodes plugin <= 3.1 Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2025-50977MEDIUMA template injection vulnerability leading to reflected cross-site scripting (XSS) has been identified in version 1.7.1, requiring authenticEPSS 0.3%CVE-2025-6012MEDIUMAuto Attachments <= 1.8.5 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-4594MEDIUMTournamatch <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-47762HIGHTinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` commentsEPSS 0.3%CVE-2024-56173MEDIUMIn Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under speciEPSS 0.3%CVE-2025-14013MEDIUMJIZHICMS Comment addcomment.html cross site scriptingEPSS 0.3%CVE-2024-42671MEDIUMA Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicioEPSS 0.3%CVE-2020-37152MEDIUMPHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS)EPSS 0.3%CVE-2025-4439HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.3%CVE-2026-111109MEDIUMWebmention <= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta TagEPSS 0.3%CVE-2025-14801MEDIUMxiweicheng TMS create createComment cross site scriptingEPSS 0.3%CVE-2024-48704MEDIUMPhpgurukul Medical Card Generation System v1.0 is vulnerable to HTML Injection in admin/contactus.php via the parameter pagedes.EPSS 0.3%CVE-2026-0695HIGHStored XSS in Time Entry Audit TrailEPSS 0.3%CVE-2025-5841MEDIUMACF Onyx Poll <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via class ParameterEPSS 0.3%CVE-2024-44573MEDIUMA stored cross-site scripting (XSS) vulnerability in the VLAN configuration of RELY-PCIe v22.2.1 to v23.1.0 allows attackers to execute arbiEPSS 0.3%CVE-2019-25377MEDIUMOPNsense 19.1 Reflected XSS via system_advanced_sysctl.phpEPSS 0.3%