Weaknesses of type CWE-79

30,316 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-100180MEDIUMJeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via CommentEPSS 0.2%CVE-2025-4957HIGHWordPress ProfileGrid plugin <= 5.9.5.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-24628MEDIUMWordPress Photo Gallery by Supsystic plugin <= 1.16.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-25837MEDIUMA stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web sEPSS 0.2%CVE-2025-6686MEDIUMMagic Buttons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button ShortcodeEPSS 0.2%CVE-2026-33628MEDIUMInvoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line ItemsEPSS 0.2%CVE-2026-2965MEDIUM07FLYCMS/07FLY-CMS/07FlyCRM System Extension edit.html cross site scriptingEPSS 0.2%CVE-2025-65187MEDIUMA Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject EPSS 0.2%CVE-2026-57762MEDIUMWordPress Simple URLs plugin <= 151 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-43915MEDIUMCoturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN usernameEPSS 0.2%CVE-2025-57929MEDIUMWordPress Double the Donation Plugin <= 2.0.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-8445MEDIUMCountdown Timer for Elementor <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'countdown_label'EPSS 0.2%CVE-2026-32612MEDIUMStatamic: privilege escalation via stored cross-site scriptingEPSS 0.2%CVE-2025-20353MEDIUMCisco Catalyst Center Cross-Site Scripting VulnerabilityEPSS 0.2%CVE-2025-50985MEDIUMdiskover-web v2.3.0 Community Edition is vulnerable to multiple reflected cross-site scripting (XSS) flaws in its web interface. UnsanitizedEPSS 0.2%CVE-2025-43926MEDIUMAn issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6. Custom AJAX calls to the AgentPreferences UpdateAJAX subaction can beEPSS 0.2%CVE-2025-50986MEDIUMdiskover-web v2.3.0 Community Edition suffers from multiple stored cross-site scripting (XSS) vulnerabilities in its administrative settingsEPSS 0.2%CVE-2024-37541MEDIUMWordPress Elementor Addons, Widgets and Enhancements – Stax plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-63834MEDIUMA stored cross-site scripting (XSS) vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. The vulnerability exists in the ssid paraEPSS 0.2%CVE-2025-67724MEDIUMTornado vulnerable to Header Injection and XSS via reason argumentEPSS 0.2%