Weaknesses of type CWE-79

30,520 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-116802MEDIUMDOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML ModeEPSS 0.2%CVE-2025-34521MEDIUMArcserve UDP < 10.2 Reflected Cross-Site Scripting (XSS)EPSS 0.2%CVE-2025-6944MEDIUMUncode Core <= 2.9.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodesEPSS 0.2%CVE-2025-53482MEDIUMIPInfo: Message key XSS through several IPInfo messages in infobox and popupEPSS 0.2%CVE-2025-43738MEDIUMA reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.QEPSS 0.2%CVE-2025-43820MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 throughEPSS 0.2%CVE-2026-119369MEDIUMWordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2022-50945MEDIUMWordPress 3dady Real-Time Web Stats 1.0 Stored XSSEPSS 0.2%CVE-2025-43812MEDIUMCross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 throEPSS 0.2%CVE-2026-3512MEDIUMWriteprint Stylometry <= 0.1 - Reflected Cross-Site Scripting via 'p' ParameterEPSS 0.2%CVE-2025-43771MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay DEPSS 0.2%CVE-2026-32112MEDIUMha-mcp has XSS via Unescaped HTML in OAuth Consent FormEPSS 0.2%CVE-2025-62051MEDIUMWordPress UDesign Core plugin <= 4.14.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-49936MEDIUMWordPress WoodMart theme < 8.3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-53701MEDIUMXSS vulnerability in Vilar VS-IPC1002 IP camerasEPSS 0.2%CVE-2026-27440MEDIUMWordPress myCred plugin <= 2.9.7.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-3554MEDIUMSherk Custom Post Type Displays <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode AttributeEPSS 0.2%CVE-2025-4775MEDIUMWordPress Infinite Scroll – Ajax Load More <= 7.4.0.1 - Authenticated(Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-46856MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2025-53839MEDIUMDRACOON Branding Service vulnerable to Cross-site ScriptingEPSS 0.2%