Weaknesses of type CWE-79

30,522 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-18131HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.2%CVE-2026-81739HIGHPaytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment CallbackEPSS 0.2%CVE-2026-86606HIGHiubenda < 3.13.7 - Unauthenticated Stored XSS via Cookie Block HTML ParserEPSS 0.2%CVE-2025-22823MEDIUMWordPress Genesis Style Shortcodes Plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-9333MEDIUMSmart Docs <= 1.1.1 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-8687MEDIUMEnter Addons <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown and Image Comparison WidgetsEPSS 0.2%CVE-2026-109370MEDIUMDocument Embedder <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block AttributeEPSS 0.2%CVE-2025-47679MEDIUMWordPress RS WP Book Showcase plugin <= 6.7.59 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-13523HIGHCross-Site Scripting (XSS) via Unescaped Display Names in Mattermost Confluence Plugin OAuth2 FlowEPSS 0.2%CVE-2025-13885MEDIUMZenost Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2025-53235HIGHWordPress Easy Social plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-50582MEDIUMStudentManage v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Add A New Course module.EPSS 0.2%CVE-2025-13843MEDIUMVigLink SpotLight By ShortCode <= 1.0.a - Authenticated (Contributor+) Stored Cross-Site Scripting via 'float' Shortcode AttributeEPSS 0.2%CVE-2025-41037MEDIUMStored Cross-Site Scripting vulnerability in appRain CMFEPSS 0.2%CVE-2026-58263HIGHJodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrierEPSS 0.2%CVE-2025-13850MEDIUMLS Google Map Router <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2025-57981MEDIUMWordPress WP Social Widget Plugin <= 2.3.1 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-1755MEDIUMMenu Icons by ThemeIsle <= 0.13.20 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-13852MEDIUMDebt.com Business in a Box <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2025-26395HIGHSolarWinds SWOSH DOM-based reflective XSS VulnerabilityEPSS 0.2%