Weaknesses of type CWE-79

30,536 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-45106MEDIUMWeblate: Stored HTML injection in editor search previewEPSS 0.2%CVE-2025-68880HIGHWordPress Simple Archive Generator plugin <= 5.2 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-7421MEDIUMPasseum Ticketing <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'shop_name' SettingEPSS 0.2%CVE-2026-6779MEDIUMOther issue in the JavaScript Engine componentEPSS 0.2%CVE-2026-1451MEDIUMrognone <= 0.6.2 - Reflected Cross-Site Scripting via 'a' ParameterEPSS 0.2%CVE-2025-0876MEDIUMXSS in Isin Basi Advertisement & IT's WorkifEPSS 0.2%CVE-2026-103897MEDIUMResponsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' AttributeEPSS 0.2%CVE-2025-27259LOWEricsson Network Manager: improper neutralization of user controlled inputEPSS 0.2%CVE-2025-10558HIGHStored Cross-site Scripting (XSS) vulnerability affecting 3DSearch in 3DSwymer on Release 3DEXPERIENCE R2025xEPSS 0.2%CVE-2025-68401MEDIUMChurchCRM has Stored Cross-Site Scripting (XSS) vulnerability that leads to session theft and account takeoverEPSS 0.2%CVE-2026-3239MEDIUMStrong Testimonials <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via testimonial_view ShortcodeEPSS 0.2%CVE-2026-20109MEDIUMCisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise Cross-Site Scripting VulnerabilityEPSS 0.2%CVE-2026-4165MEDIUMWorksuite HR, CRM and Project Management create cross site scriptingEPSS 0.2%CVE-2025-66500MEDIUMFoxit webplugins.foxit.com Stored Cross-Site Scripting via postMessage VulnerabilityEPSS 0.2%CVE-2024-6224MEDIUMSend email only on Reply to My Comment <= 1.0.6 - Stored XSS via CSRFEPSS 0.2%CVE-2025-62142MEDIUMWordPress Post Video Players plugin <= 1.163 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-39328HIGHChurchCRM has Stored XSS in Social Profile FieldsEPSS 0.2%CVE-2026-109604HIGHERPNext before 15.112.0 Stored XSS via Tool View Record NamesEPSS 0.2%CVE-2019-25233MEDIUMAVE DOMINAplus 1.10.x Cross-Site Request Forgery and XSS VulnerabilitiesEPSS 0.2%CVE-2026-77912HIGHStored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipelineEPSS 0.2%