Weaknesses of type CWE-79

30,305 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-8038MEDIUMFaces of Users <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode AttributeEPSS 0.2%CVE-2025-61255MEDIUMBank Locker Management System by PHPGurukul is affected by a Cross-Site Scripting (XSS) vulnerability via the /search parameter, where unsanEPSS 0.2%CVE-2024-13547MEDIUMaThemes Addons for Elementor <= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2024-13587MEDIUMZigaform – Price Calculator & Cost Estimation Form Builder Lite <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-48156MEDIUMWordPress Image Wall plugin <= 3.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-4353MEDIUMCI HUB Connector <= 1.2.106 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode AttributeEPSS 0.2%CVE-2024-41735MEDIUMCross-Site Scripting (XSS) vulnerability in SAP Commerce BackofficeEPSS 0.2%CVE-2025-15355MEDIUMNetVision Information｜ISOinsight - Reflected Cross-site ScriptingEPSS 0.2%CVE-2026-95807MEDIUMFV Player 8 <= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode AttributeEPSS 0.2%CVE-2025-52204MEDIUMA Cross-Site Scripting (XSS) vulnerability exists in Znuny::ITSM 6.5.x in the customer.pl endpoint via the OTRSCustomerInterface parameterEPSS 0.2%CVE-2026-6997MEDIUMBDCOM P3310D New RMON History cross site scriptingEPSS 0.2%CVE-2024-3773MEDIUMLiveJournal Shortcode <= 1.1.1 - Contributor+ Stored XSS via ShortcodeEPSS 0.2%CVE-2024-33401MEDIUMCross Site Scripting vulnerability in DedeCMS v.5.7.113 allows a remote attacker to run arbitrary code via the mnum parameter.EPSS 0.2%CVE-2026-28771MEDIUMReflected XSS In /index.cgi Endpoint On IDC Satellite Receiver Web Management Interface Version 101EPSS 0.2%CVE-2026-30838MEDIUMleague/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag namesEPSS 0.2%CVE-2025-10373MEDIUMPortabilis i-Educar educar_turma_tipo_cad.php cross site scriptingEPSS 0.2%CVE-2023-53903MEDIUMWebsiteBaker 2.13.3 Stored Cross-Site Scripting via SVG File UploadEPSS 0.2%CVE-2025-56008MEDIUMCross site scripting (XSS) vulnerability in KeeneticOS before 4.3 at "Wireless ISP" page allows attackers located near to the router to takeEPSS 0.2%CVE-2023-53898MEDIUMRukovoditel 3.4.1 Multiple Stored Cross-Site Scripting via ConfigurationEPSS 0.2%CVE-2021-38131MEDIUMCross-Site Scripting (XSS) VulnerabilityEPSS 0.2%