Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-27178MEDIUMMajorDoMo Stored Cross-Site Scripting via Method Parameters to ShoutboxEPSS 0.3%CVE-2026-35576HIGHChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.phpEPSS 0.3%CVE-2026-21292MEDIUMAdobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.3%CVE-2021-47913MEDIUMPHP Melody 3.0 Persistent Cross-Site Scripting via Video EditorEPSS 0.3%CVE-2025-3813MEDIUMRoyal Elementor Addons and Templates <= 1.7.1020 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-107796MEDIUMJivejdon through commit ee67a65e Reflected XSS via taggedThreadList.jsp tagID and count ParametersEPSS 0.3%CVE-2024-51950MEDIUMStored XSS in Server Admin under Services > lifecycleinfosEPSS 0.3%CVE-2026-95717MEDIUMAuthenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management InterfaceEPSS 0.3%CVE-2024-35145MEDIUMIBM Maximo Application Suite cross-site scriptingEPSS 0.3%CVE-2025-5754MEDIUMUseful Tab Block – Responsive & AMP-Compatible <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via className ParameterEPSS 0.3%CVE-2024-13987MEDIUMImproper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Synology RADIUS Server allows remote aEPSS 0.3%CVE-2024-51949MEDIUMStored XSS vulnerability in Rest Services under OGCFeature Service and Map ServiceEPSS 0.3%CVE-2024-51960MEDIUMStored XSS in ArcGIS Server Administrator DirectoryEPSS 0.3%CVE-2026-1807MEDIUMInteractiveCalculator for WordPress <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode AttributeEPSS 0.3%CVE-2025-43861MEDIUMManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflectionEPSS 0.3%CVE-2026-0316LOWPAN-OS: Stored Cross-Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-13443MEDIUMEasypromos Plugin <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2026-33664HIGHKestra Vulnerable to Stored Cross-Site Scripting via Flow YAML FieldsEPSS 0.3%CVE-2023-54349MEDIUMAmazCart CMS 3.4 Reflected Cross-Site Scripting via SearchEPSS 0.3%CVE-2026-120443MEDIUMGoFound through 1.4.1 Stored XSS via Admin Dashboard Search ResultsEPSS 0.3%