Weaknesses of type CWE-79

30,495 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-13527MEDIUMPhilantro – Donations and Donor Management <= 5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via donate ShortcodeEPSS 0.2%CVE-2025-66403MEDIUMFileRise Vulnerable to Stored XSS via SVG UploadEPSS 0.2%CVE-2026-16273MEDIUMNarrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post MetaEPSS 0.2%CVE-2026-21483MEDIUMlistmonk Vulnerable to Stored XSS Leading to Admin Account TakeoverEPSS 0.2%CVE-2024-45094MEDIUMIBM DS8900F and DS8A00 Hardware Management Console (HMC) cross-site scriptingEPSS 0.2%CVE-2024-13400MEDIUMKona Gallery Block <= 1.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-36906MEDIUMCross Site Scripting vulnerability in iotgateway v.3.0.1 allows a remote attacker to execute arbitrary code via the Log Record FunctionEPSS 0.2%CVE-2026-6793MEDIUMStored XSS in Bifra Engineering's Q-smart NexT PollEPSS 0.2%CVE-2026-119054MEDIUMMultiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-urlEPSS 0.2%CVE-2025-66648HIGH`vega-functions` vulnerable to Cross-site Scripting via `setdata` functionEPSS 0.2%CVE-2026-0580MEDIUMSourceCodester API Key Manager App Import Key cross site scriptingEPSS 0.2%CVE-2026-16066MEDIUMWelcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product NameEPSS 0.2%CVE-2026-8309MEDIUMReflected XSS in Armiya Technologies' Access Control SystemEPSS 0.2%CVE-2026-119152MEDIUMAppointment Booking Plugin <= 5.7.6 - Unauthenticated Stored Cross-Site Scripting via Customer Email FieldEPSS 0.2%CVE-2026-34396MEDIUMAVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin PanelEPSS 0.2%CVE-2026-0512MEDIUMCross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog)EPSS 0.2%CVE-2026-15386MEDIUMMeow Gallery < 5.5.2 - Author+ Stored XSS via Attachment Alt-TextEPSS 0.2%CVE-2026-48149HIGHBudibase: Stored XSS in Text component: BASIC users execute JS in admin session via MarkdownViewer innerHTML + CDN+srcdoc CSP bypassEPSS 0.2%CVE-2026-64795MEDIUMJoomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensionsEPSS 0.2%CVE-2026-14230MEDIUMECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater BindingsEPSS 0.2%