Weaknesses of type CWE-79

30,306 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-13416LOWCMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Stored XSS via niteoCS_socialmediaEPSS 0.2%CVE-2025-31901HIGHWordPress Digihood HTML Sitemap Plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-54687MEDIUMWordPress JetTabs Plugin plugin <= 2.2.9.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-7205MEDIUMGiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-1437MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in Graylog Web InterfaceEPSS 0.2%CVE-2025-22767HIGHWordPress GlobalPayments WooCommerce Plugin <= 1.13.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-86491LOWIn JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploadsEPSS 0.2%CVE-2024-6361HIGHImproper Neutralization vulnerability (XSS) has been discovered in OpenText™ ALM Octane product.EPSS 0.2%CVE-2025-50367MEDIUMA stored blind XSS vulnerability exists in the Contact Page of the Phpgurukul Medical Card Generation System 1.0 mcgs/contact.php. The name EPSS 0.2%CVE-2025-54699MEDIUMWordPress Masteriyo - LMS Plugin plugin <= 1.18.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-15695LOWGTranslate < 3.0.10 - Admin+ Stored XSSEPSS 0.2%CVE-2025-67475NONEStored XSS through edit summaries in MW CoreEPSS 0.2%CVE-2024-28973MEDIUMDell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a Stored Cross-Site Scripting Vulnerability. EPSS 0.2%CVE-2024-13463MEDIUMSeatReg <= 1.56.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-31899HIGHWordPress Awesome Logos plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-12163MEDIUMStored XSS in Fortra File Integrity Monitoring (FIM)EPSS 0.2%CVE-2026-3343MEDIUMWatchGuard Firebox Reflected Cross-Site-Scripting (XSS) Vulnerability in Fireware Web UIEPSS 0.2%CVE-2026-30879MEDIUMbaserCMS: Cross-site scripting vulnerability in blog postEPSS 0.2%CVE-2024-12037MEDIUMFrontend Content Forms for User Submissions (UGC) <= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2023-37535HIGHHCL Domino Volt and Domino Leap are affected by a Cross-site scripting (XSS) vulnerabilityEPSS 0.2%