Weaknesses of type CWE-79

30,536 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-20109MEDIUMCisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise Cross-Site Scripting VulnerabilityEPSS 0.2%CVE-2026-40353MEDIUMwger: Stored XSS via Unescaped License Attribution FieldsEPSS 0.2%CVE-2024-6224MEDIUMSend email only on Reply to My Comment <= 1.0.6 - Stored XSS via CSRFEPSS 0.2%CVE-2026-4075MEDIUMBWL Advanced FAQ Manager Lite <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sbox_id' Shortcode AttributeEPSS 0.2%CVE-2025-52035MEDIUMA vulnerability in NotesCMS and specifically in the page /index.php?route=notes. The manipulation of the title of the service descriptions lEPSS 0.2%CVE-2026-39328HIGHChurchCRM has Stored XSS in Social Profile FieldsEPSS 0.2%CVE-2025-68401MEDIUMChurchCRM has Stored Cross-Site Scripting (XSS) vulnerability that leads to session theft and account takeoverEPSS 0.2%CVE-2025-52036MEDIUMA vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=categories.EPSS 0.2%CVE-2025-31419MEDIUMWordPress Churel plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-41107MEDIUMStored XSS in Smart SchoolEPSS 0.2%CVE-2025-22638MEDIUMWordPress Product Table For WooCommerce Plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62142MEDIUMWordPress Post Video Players plugin <= 1.163 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-109612HIGHFrappe ERPNext before 15.120.0 Stored XSS via Report ViewEPSS 0.2%CVE-2025-66500MEDIUMFoxit webplugins.foxit.com Stored Cross-Site Scripting via postMessage VulnerabilityEPSS 0.2%CVE-2026-4165MEDIUMWorksuite HR, CRM and Project Management create cross site scriptingEPSS 0.2%CVE-2025-62140MEDIUMWordPress Locatoraid Store Locator plugin <= 3.9.68 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-40479MEDIUMKimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member WidgetEPSS 0.2%CVE-2026-1278MEDIUMMandatory Field <= 1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings FieldsEPSS 0.2%CVE-2026-39332HIGHChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.phpEPSS 0.2%CVE-2026-109653HIGHFrappe ERPNext before 15.119.0 Stored XSS Leading to Account TakeoverEPSS 0.2%