Weaknesses of type CWE-79

30,469 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-111442MEDIUMBackdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potenEPSS 0.2%CVE-2026-119160MEDIUMSmart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter blockEPSS 0.2%CVE-2026-59664MEDIUMMultiple vulnerabilities in the Repasat applicationEPSS 0.2%CVE-2026-93633MEDIUMZimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet CharactersEPSS 0.2%CVE-2024-5848MEDIUMReflected Cross-Site Scripting (XSS) in Multiple WSO2 Products Due to Improper Input ValidationEPSS 0.2%CVE-2025-23988HIGHWordPress ghostwriter theme <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-22687HIGHWordPress tuaug4 theme <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-5538MEDIUMBNS Featured Category <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-2864LOWReflected Cross-Site Scripting (XSS) vulnerability in saTECH BCUEPSS 0.2%CVE-2025-5541MEDIUMRunners Log <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-47678HIGHWordPress FunnelCockpit plugin <= 1.4.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-70458MEDIUMA DOM-based Cross-Site Scripting (XSS) vulnerability exists in the DomainCheckerApp class within domain/script.js of Sourcecodester Domain AEPSS 0.2%CVE-2025-57920MEDIUMWordPress Category Featured Images Extended Plugin <= 1.52 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-1591MEDIUMStored XSS via Attachments Feature in https://pdfonline.foxit.com/EPSS 0.2%CVE-2025-26997HIGHWordPress Wireless Butler plugin <= 1.0.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-107397MEDIUMIndico: Cross-Site-Scripting in minutes editorEPSS 0.2%CVE-2025-22789HIGHWordPress polka dots theme <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-47680HIGHWordPress xili-tidy-tags plugin <= 1.12.06 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-11220MEDIUMElementor <= 3.33.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Text PathEPSS 0.2%CVE-2026-6371MEDIUMStored XSS in Limatek's LimRAD NACEPSS 0.2%