Weaknesses of type CWE-79

30,316 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-58519MEDIUMStored XSS through Cargo's map formatEPSS 0.2%CVE-2025-63639MEDIUMThe chat feature in the application Sourcecodester FAQ Bot with AI Assistant v1.0 is vulnerable to Cross-Site Scripting (XSS) due to impropeEPSS 0.2%CVE-2026-77871MEDIUMPost Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-94573HIGHRepeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field ValueEPSS 0.2%CVE-2026-108566MEDIUMInstantSoft icms2 Private Message index.tpl.php index cross site scriptingEPSS 0.2%CVE-2025-4591MEDIUMWeluka Lite <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-14467MEDIUMWP Job Portal <= 2.4.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Job Description FieldEPSS 0.2%CVE-2025-26514MEDIUMCVE-2025-26514 Reflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale)EPSS 0.2%CVE-2026-97641HIGHRelevanssi <= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment ContentEPSS 0.2%CVE-2026-96752HIGHZero Spam for WordPress <= 5.7.10 - Unauthenticated Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 IntegrationEPSS 0.2%CVE-2025-61087MEDIUMSourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the Customer Name field under Customer MEPSS 0.2%CVE-2024-56231MEDIUMWordPress SaasPricing plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-45002MEDIUMVigybag v1.0 and before is vulnerable to Cross Site Scripting (XSS) via the upload profile picture function under my profile.EPSS 0.2%CVE-2026-65557MEDIUMWordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-66475MEDIUMWordPress Checkout Field Editor for WooCommerce &#8211; Checkout Manager plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-39595MEDIUM[CVE-2024-39594] Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Warehouse - Business Planning and SimulationEPSS 0.2%CVE-2024-4754MEDIUMStored XSS in Next4Biz's BPMEPSS 0.2%CVE-2026-106033MEDIUMAnsible: ansible-ui: ansible ui dom xss in /redirect next parameterEPSS 0.2%CVE-2026-119680HIGHStored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart FeatureEPSS 0.2%CVE-2024-8750MEDIUMCross-site Scripting vulnerability in Idoit proEPSS 0.2%