Weaknesses of type CWE-79

30,300 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-96874LOWStored XSS in Cargo Drilldown tab namesEPSS 0.3%CVE-2025-32984MEDIUMNETSCOUT nGeniusONE before 6.4.0 b2350 allows Stored Cross-Site Scripting (XSS) via a certain POST parameter.EPSS 0.3%CVE-2024-9343MEDIUMIn Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.EPSS 0.3%CVE-2025-49057HIGHWordPress WP Voting Plugin <= 1.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-28445HIGHTypebot: Stored XSS via Rating Block Custom Icon Bypasses isUnsafe Sandbox in Builder PreviewEPSS 0.3%CVE-2024-3648MEDIUMShareThis Share Buttons <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via sharethis-inline-buttons ShortcodeEPSS 0.3%CVE-2024-9585MEDIUMImage Map Pro <= 6.0.20 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-2889MEDIUMLink Library <= 7.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Additional ParametersEPSS 0.3%CVE-2024-11384MEDIUMArena.IM – Live Blogging for real-time events <= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-28016MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login aEPSS 0.3%CVE-2025-60447MEDIUMA stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template coEPSS 0.3%CVE-2024-10538MEDIUMHappy Addons for Elementor <= 3.12.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image ComparisonEPSS 0.3%CVE-2025-1748MEDIUMHTML injection vulnerability in OpenCartEPSS 0.3%CVE-2025-48993MEDIUMGroup-Office vulnerable to reflected XSS via Look and Feel Formatting inputEPSS 0.3%CVE-2025-49058HIGHWordPress SoundSt SEO Search plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-50452MEDIUMWordPress Nexter Blocks plugin <= 3.3.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-8494MEDIUMPermalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post TitleEPSS 0.3%CVE-2024-35291MEDIUMCross-site scripting vulnerability exists in Splunk Config Explorer versions prior to 1.7.16. If this vulnerability is exploited, an arbitraEPSS 0.3%CVE-2026-10770MEDIUMAnti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042EPSS 0.3%CVE-2024-13739MEDIUMNewsletters <= 4.9.9.7 - Reflected Cross-Site Scripting via To ParameterEPSS 0.3%