Weaknesses of type CWE-79

30,524 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-9281MEDIUMMaster Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension)EPSS 0.2%CVE-2025-22497MEDIUMWordPress Simple Google Calendar Outlook Events Block Widget plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-31433MEDIUMWordPress Magic Embeds plugin <= 3.1.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-38940MEDIUMCross Site Scripting vulnerability in RafyMrX TOKO-ONLINE-ROTI v.1.0 allows a remote attacker to execute arbitrary code via the detail_produEPSS 0.2%CVE-2025-31090MEDIUMWordPress Dropdown Multisite selector plugin < 0.9.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-28108HIGHWordPress LambertGroup - AllInOne - Banner with Thumbnails plugin <= 3.8 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67291MEDIUMA stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1 allows attackers to execute arbitrary web scriptsEPSS 0.2%CVE-2026-4077MEDIUMEcover Builder For Dummies <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode AttributeEPSS 0.2%CVE-2026-30566MEDIUMA Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulnerability is located iEPSS 0.2%CVE-2025-52206MEDIUMISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage.EPSS 0.2%CVE-2026-111068MEDIUMDesignSetGo <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block AttributeEPSS 0.2%CVE-2026-60639HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are EPSS 0.2%CVE-2026-1438MEDIUMReflected Cross-Site Scripting (XSS) vulnerability in Graylog Web InterfaceEPSS 0.2%CVE-2026-60633HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are EPSS 0.2%CVE-2026-33370MEDIUMAn issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Zimbra EPSS 0.2%CVE-2025-69318HIGHWordPress JobWP plugin <= 2.4.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-11854MEDIUMCross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 ProductsEPSS 0.2%CVE-2025-64872MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2025-68041HIGHWordPress Omnichannel for WooCommerce plugin <= 1.3.65 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-23735MEDIUMCross Site Scripting (XSS) vulnerability in in the S/MIME certificate upload functionality of the User Profile pages in savignano S/Notify bEPSS 0.2%