Weaknesses of type CWE-79

30,533 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-7269MEDIUMSourceCodester Pharmacy Sales and Inventory System index.php cross site scriptingEPSS 0.2%CVE-2026-1608MEDIUMVideo Onclick <= 0.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%CVE-2026-61823HIGHcode16 Sharp vulnerable to stored XSS via iframe srcdoc AttributeEPSS 0.2%CVE-2025-10018MEDIUMMultiple Stored XSS in QuickCMSEPSS 0.2%CVE-2025-67557MEDIUMWordPress WP eBay Product Feeds plugin <= 3.4.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-10529MEDIUMwestboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scriptingEPSS 0.2%CVE-2026-120421MEDIUMReflected XSS via client window id in URL client window modeEPSS 0.2%CVE-2024-54540MEDIUMThe issue was addressed with improved input sanitization. This issue is fixed in Apple Music 1.5.0.152 for Windows. Processing maliciously cEPSS 0.2%CVE-2026-5451MEDIUMExtensions for Leaflet Map <= 4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'elevation-track' ShortcodeEPSS 0.2%CVE-2026-18205MEDIUMXSS in Ticimax Informatics' Ticimax E-Commerce PlatformEPSS 0.2%CVE-2025-58621MEDIUMWordPress PuzzleMe for WordPress Plugin <= 1.2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-57996MEDIUMWordPress Buckets Plugin <= 0.3.9 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-58260MEDIUMWordPress Highlight and Share – Social Text and Image Sharing plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-47058LOWCross-site Scripting (XSS) - stored (edit form HTML field)EPSS 0.2%CVE-2025-58652MEDIUMWordPress Carousel Ultimate Plugin <= 1.8 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-40890MEDIUMStored Cross-Site Scripting (XSS) in Dashboards in Guardian/CMC before 25.4.0EPSS 0.2%CVE-2025-58001MEDIUMWordPress Compact Archives plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58614MEDIUMWordPress Tooltipy Plugin <= 5.5.6 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-120648MEDIUMCGI versions before 5.00 for Perl allow HTML injection via text containing --> in commentEPSS 0.2%CVE-2025-58786MEDIUMWordPress Ibtana – Ecommerce Product Addons plugin <= 0.4.7.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%