Weaknesses of type CWE-79

30,508 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-34598HIGHYesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"EPSS 0.2%CVE-2026-35008MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id ParameterEPSS 0.2%CVE-2025-67984HIGHWordPress NPS computy plugin <= 2.8.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-119218MEDIUMGreenshift <= 13.2.2 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Interaction Layer attach-attribute to Counter data-prefixEPSS 0.2%CVE-2023-37508LOWHCL DevOps Plan is susceptible to a Cross-Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-12047MEDIUMpgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception textEPSS 0.2%CVE-2026-2396MEDIUMList View Google Calendar <= 7.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via Event DescriptionEPSS 0.2%CVE-2025-68863HIGHWordPress iContact for Gravity Forms plugin <= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-2404MEDIUMXSS in Ubit Information Technologies' STOYSEPSS 0.2%CVE-2025-69302HIGHWordPress DesignThemes Core Features plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-46241MEDIUMPHPGurukul Dairy Farm Shop Management System v1.1 is vulnerable to Cross-Site Scripting (XSS) via the pname parameter in add_product.php andEPSS 0.2%CVE-2026-120019MEDIUMW3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify PlaceholderEPSS 0.2%CVE-2026-22678MEDIUMWebmin < 2.641 Stored XSS via System and Server StatusEPSS 0.2%CVE-2026-46642MEDIUMdraw.io: XSS via crafted cell label when opening a .drawio fileEPSS 0.2%CVE-2026-35009MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id ParameterEPSS 0.2%CVE-2024-57278MEDIUMA reflected Cross-Site Scripting (XSS) vulnerability exists in /webscan/sqlmap/index.html in QingScan <=v1.8.0. The vulnerability is caused EPSS 0.2%CVE-2026-35015MEDIUMOpen ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket ParameterEPSS 0.2%CVE-2026-63171MEDIUMOmnispace Agora Project < 26.10.0 Stored XSS via Category DescriptionEPSS 0.2%CVE-2026-110802MEDIUMAltair: DOM-based XSS via attacker-controlled script URLs in the iframe sandboxEPSS 0.2%CVE-2026-11878HIGHReflected Cross-Site Scripting vulnerability in OpenText Access ManagerEPSS 0.2%