Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-3178HIGHName Directory <= 1.32.1 - Unauthenticated Stored Cross-Site Scripting via 'name_directory_name'EPSS 0.3%CVE-2026-12176MEDIUMSourceCodester CET Automated Grading System with AI Predictive Analytics index.php cross site scriptingEPSS 0.3%CVE-2024-46226MEDIUMA stored cross site scripting (XSS) vulnerability in HelpDeskZ < v2.0.2 allows remote attackers to execute arbitrary JavaScript in the adminEPSS 0.3%CVE-2025-30626HIGHWordPress Multimedia Playlist Slider Addon for WPBakery Page Builder <= 2.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-1074HIGHWP App Bar <= 1.5 - Unauthenticated Stored Cross-Site Scripting via 'app-bar-features' ParameterEPSS 0.3%CVE-2025-5767MEDIUMCrowdfunding for WooCommerce <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via width ParameterEPSS 0.3%CVE-2024-6877CRITICALReflected XSS in Eliz Software's PanelEPSS 0.3%CVE-2025-5800MEDIUMTestimonial Post type <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_play ParameterEPSS 0.3%CVE-2025-61078MEDIUMCross-site scripting (XSS) vulnerability in Request IP form in phpIPAM v1.7.3 allows remote attackers to inject arbitrary web script or HTMLEPSS 0.3%CVE-2024-51948MEDIUMStored XSS vulnerability in Rest Services under Job IDEPSS 0.3%CVE-2025-0667HIGHBOINC Server Stored XSS Injection in pm.phpEPSS 0.3%CVE-2025-6623MEDIUMStored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and RedirectionEPSS 0.3%CVE-2026-46547MEDIUMNocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URLEPSS 0.3%CVE-2025-1230MEDIUMCross-Site Scripting (XSS) vulnerability in PrestashopEPSS 0.3%CVE-2017-20290MEDIUMDiscourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribedEPSS 0.3%CVE-2024-51945MEDIUMStored XSS issues in Server Admin APIEPSS 0.3%CVE-2026-104450HIGHYesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage ActionEPSS 0.3%CVE-2026-6999MEDIUMBIVOCOM TR321 Wireless Setting cross site scriptingEPSS 0.3%CVE-2021-47912MEDIUMPHP Melody 3.0 Non-Persistent Cross-Site Scripting via Multiple ParametersEPSS 0.3%CVE-2025-55134MEDIUMIn Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js.EPSS 0.3%