Weaknesses of type CWE-79

30,473 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-6085MEDIUMStored Cross-Site Scripting in StockAgile by Novadigits technologiesEPSS 0.2%CVE-2026-25558MEDIUMQloApps 1.7.0 Stored XSS via SVG File Upload in Admin File ManagerEPSS 0.2%CVE-2025-2986MEDIUMIBM Maximo Asset Management cross-site scriptingEPSS 0.2%CVE-2025-69723MEDIUMA reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context ofEPSS 0.2%CVE-2025-68524HIGHWordPress Avante theme < 3.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-6082MEDIUMStored Cross-Site Scripting in StockAgile by Novadigits technologiesEPSS 0.2%CVE-2024-51106MEDIUMA cross-site scripting (XSS) vulnerability in the component mcgs/admin/aboutus.php of PHPGURUKUL Medical Card Generation System using PHP anEPSS 0.2%CVE-2025-13693MEDIUMImage Photo Gallery Final Tiles Grid <= 3.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'Custom Scripts' SettingEPSS 0.2%CVE-2026-39731HIGHWordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-49392MEDIUMStored cross-site scripting (XSS) vulnerability on enrollment invitation page. The following products are affected: Acronis Cyber Files (WinEPSS 0.2%CVE-2024-12477MEDIUMAvada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple WidgetsEPSS 0.2%CVE-2025-13537MEDIUMLive Composer – Free WordPress Website Builder <= 2.0.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-6024MEDIUMCross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious WebsitesEPSS 0.2%CVE-2026-6086MEDIUMStored Cross-Site Scripting in StockAgile by Novadigits technologiesEPSS 0.2%CVE-2026-39720HIGHWordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2021-47906MEDIUMBloofoxCMS 0.5.2.1 - 'text' Stored Cross Site ScriptingEPSS 0.2%CVE-2026-107393MEDIUMFreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP HeaderEPSS 0.2%CVE-2026-57317HIGHWordPress Simply Schedule Appointments plugin <= 1.6.12.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-22339HIGHWordPress WPJobster theme <= 6.3.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-60144MEDIUMWordPress Lenix scss compiler Plugin <= 1.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%