Weaknesses of type CWE-79

30,494 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-3742MEDIUMYiFang CMS D_singlePage.php update cross site scriptingEPSS 0.2%CVE-2026-27177MEDIUMMajorDoMo Stored Cross-Site Scripting via Property Set EndpointEPSS 0.2%CVE-2021-29669MEDIUMIBM Jazz Foundation cross-site scriptingEPSS 0.2%CVE-2021-47873MEDIUMVestaCP < 0.9.8-25 - Stored Cross-Site ScriptingEPSS 0.2%CVE-2024-53569MEDIUMA stored cross-site scripting (XSS) vulnerability in the New Goal Creation section of Volmarg Personal Management System v1.4.65 allows authEPSS 0.2%CVE-2026-92411MEDIUMWP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag NameEPSS 0.2%CVE-2025-52486MEDIUMDNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjectsEPSS 0.2%CVE-2025-28094MEDIUMshopxo v6.4.0 has a ssrf/xss vulnerability in multiple places.EPSS 0.2%CVE-2026-3468MEDIUMA stored Cross-Site Scripting (XSS) vulnerability has been identified in the SonicWall Email Security appliance due to improper neutralizatiEPSS 0.2%CVE-2026-87777MEDIUMHostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget AttributeEPSS 0.2%CVE-2026-0587MEDIUMXinhu Rainrock RockOA Cover Image rock_page_gong.php cross site scriptingEPSS 0.2%CVE-2026-85001MEDIUMEmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle AttributeEPSS 0.2%CVE-2024-53568MEDIUMA stored cross-site scripting (XSS) vulnerability in the Image Upload section of Volmarg Personal Management System v1.4.65 allows authenticEPSS 0.2%CVE-2025-50976MEDIUMIPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVER, REMARK, and TLS_HOSTNAME quEPSS 0.2%CVE-2025-60302MEDIUMcode-projects Client Details System 1.0 is vulnerable to Cross Site Scripting (XSS). When adding customer information, the client details syEPSS 0.2%CVE-2025-57681MEDIUMThe WorklogPRO - Timesheets for Jira plugin in Jira Data Center before version 4.23.6-jira10 and before version 4.23.5-jira9 allows users anEPSS 0.2%CVE-2025-26548HIGHWordPress Random Image Selector plugin <= 1.5.6 - Reflected Cross-Site Scripting vulnerabilityEPSS 0.2%CVE-2025-60304MEDIUMcode-projects Simple Scheduling System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Subject Description field.EPSS 0.2%CVE-2025-34262MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devices/name/{agent_id}EPSS 0.2%CVE-2025-53205HIGHWordPress Radio Player Shoutcast & Icecast <= 4.4.7 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%