Weaknesses of type CWE-79

30,301 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-8306MEDIUMStored XSS in Armiya Technologies' Access Control SystemEPSS 0.3%CVE-2026-86507MEDIUMApache Roller: Stored XSS in comment moderation via comment author URLEPSS 0.3%CVE-2024-43351MEDIUMWordPress Bravada theme <= 1.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-23722CRITICALWeGIA has a Reflected Cross-Site Scripting (XSS) vulnerability allowing arbitrary code execution and UI redressing.EPSS 0.3%CVE-2026-51081MEDIUMA cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and Proxmox Virtual Environment (PVE) 8.x 4.3.16 aEPSS 0.3%CVE-2026-88593MEDIUMkkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled EPSS 0.3%CVE-2026-77818MEDIUMReflected HTML Injection via Form Hijacking in Yordam Informatics's Library Automation SystemEPSS 0.3%CVE-2025-2076MEDIUMbinlayerpress <= 1.1 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2025-0599HIGHStored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2026-60092MEDIUMAVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants PanelEPSS 0.3%CVE-2024-49319MEDIUMWordPress Awesome Contact Form7 for Elementor plugin <= 3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-4322MEDIUMXSS in Raera's DestekzEPSS 0.3%CVE-2026-1099MEDIUMAdministrative Shortcodes <= 0.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'login' and 'logout' Shortcode AttributesEPSS 0.3%CVE-2022-50968MEDIUMuBidAuction 2.0.1 auctions manage Reflected XSSEPSS 0.3%CVE-2025-31501HIGHBest Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink.EPSS 0.3%CVE-2025-14745MEDIUMRSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wp-rss-aggregator ShortcodeEPSS 0.3%CVE-2023-5597MEDIUMStored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2024-51915MEDIUMWordPress LiteSpeed Cache plugin <= 6.5.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-42550MEDIUMA cross-site scripting (XSS) vulnerability in the component /email/welcome.php of Mini Inventory and Sales Management System commit 18aa3d aEPSS 0.3%CVE-2026-3529MEDIUMGoogle Analytics GA4 - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-024EPSS 0.3%