Weaknesses of type CWE-79

30,300 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-30526MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Zoo Management System v1.0. The vulnerability is located in thEPSS 0.3%CVE-2024-28794MEDIUMIBM InfoSphere Information Server cross-site scriptingEPSS 0.3%CVE-2024-37246MEDIUMWordPress Gallery Slideshow plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-87870MEDIUMNinja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API ParametersEPSS 0.3%CVE-2024-44063MEDIUMWordPress Happyforms plugin <= 1.26.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-6235MEDIUMExtremeControl (NAC) 'onmouseover' XSSEPSS 0.3%CVE-2026-15161MEDIUMNinja Forms - Excel Export <= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'filter' ParameterEPSS 0.3%CVE-2026-1097MEDIUMThemeRuby Multi Authors <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode AttributesEPSS 0.3%CVE-2025-5990HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty ControllerEPSS 0.3%CVE-2024-43346MEDIUMWordPress Modal Window – create popup modal window plugin <= 6.0.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-4783MEDIUMExclusive Addons for Elementor <= 2.7.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer WidgetEPSS 0.3%CVE-2026-15889MEDIUMAruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post ContentEPSS 0.3%CVE-2024-35708MEDIUMWordPress Rife Free theme <= 2.4.19 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-10881MEDIUMLUNA RADIO PLAYER <= 6.24.11.07 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2026-6827MEDIUMjusthtml before 1.17.0 Multiple Cross-Site Scripting VulnerabilitiesEPSS 0.3%CVE-2024-37101MEDIUMWordPress WP Post Author plugin <= 3.6.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7486MEDIUMEbook Store <= 5.8012 - Authenticated (Administrator+) Stored Cross-Site Scripting via Order DetailsEPSS 0.3%CVE-2025-14069MEDIUMSchema & Structured Data for WP & AMP <= 1.54 - Authenticated (Contributor+) Stored Cross-Site Scripting via User Custom SchemaEPSS 0.3%CVE-2026-1279MEDIUMEmployee Directory <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_title' Shortcode AttributeEPSS 0.3%CVE-2026-102830MEDIUMJupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)EPSS 0.3%