Weaknesses of type CWE-79

30,299 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-79719MEDIUMReflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perEPSS 0.3%CVE-2024-41753MEDIUMIBM Cloud Pak for Business Automation cross-site scriptingEPSS 0.3%CVE-2026-1792MEDIUMGeo Widet <= 1.0 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2026-108931MEDIUMNetcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scriptingEPSS 0.3%CVE-2024-5708MEDIUMWPBakery <= 7.7 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-5751MEDIUMjusthtml before 1.14.0 Mutation XSS via custom sanitization policiesEPSS 0.3%CVE-2025-31597MEDIUMWordPress Ultimate Live Cricket WordPress Lite plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-47547MEDIUMWordPress SendPulse Email Marketing Newsletter plugin <= 2.1.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-4366MEDIUMSpectra – WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-22245MEDIUMVMware NSX contains a stored Cross-Site Scripting (XSS) vulnerability in the router port due to improper input validation.EPSS 0.3%CVE-2024-13308LOWBrowser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072EPSS 0.3%CVE-2024-5819MEDIUMGutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data AttributesEPSS 0.3%CVE-2026-92584MEDIUMAVideo through 29.0 Stored Cross-Site Scripting via User-Agent HeaderEPSS 0.3%CVE-2024-7064MEDIUMElementsKit Pro <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-67333MEDIUMbetter-auth before 1.6.13 Stored XSS via javascript redirect_uriEPSS 0.3%CVE-2026-97224MEDIUMExcalidraw Imported File restore.ts cross site scriptingEPSS 0.3%CVE-2024-5962MEDIUMReflected Cross-Site Scripting (XSS) in Authentication Endpoint of Multiple WSO2 Products Due to Missing Output EncodingEPSS 0.3%CVE-2024-1988MEDIUMPost Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-80180MEDIUMApache Allura: Stored XSS via markdown HTML processingEPSS 0.3%CVE-2026-105808MEDIUMSourceCodester Simple Student Information System searchresults.php clean cross site scriptingEPSS 0.3%