Weaknesses of type CWE-79

30,537 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-21664MEDIUMHackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php delivery script of RevEPSS 0.2%CVE-2026-118634MEDIUMEvents Made Easy <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode AttributeEPSS 0.2%CVE-2025-62149MEDIUMWordPress Add Custom Codes plugin <= 4.80 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-84815MEDIUMWordPress Enfold theme <= 8.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-41026MEDIUMMultiple vulnerabilities in GDTallerEPSS 0.2%CVE-2026-56589HIGHHCL BigFix Service Management is affected by multiple security vulnerabilities.EPSS 0.2%CVE-2025-10554HIGHStored Cross-site Scripting (XSS) vulnerability affecting Requirements in ENOVIA Product Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025xEPSS 0.2%CVE-2024-9477MEDIUMXSS in AirTies' Air4443 FirmwareEPSS 0.2%CVE-2026-119098MEDIUMLifterLMS <= 10.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question AnswerEPSS 0.2%CVE-2023-54360MEDIUMJoomla JLex Review 6.0.1 Reflected XSS via review_id ParameterEPSS 0.2%CVE-2025-5085MEDIUMwp-nano-ad <= 1.31 - Authenticated (Administrator+) Stored Cross-Site Scripting via blogrole_link ParameterEPSS 0.2%CVE-2025-3630MEDIUMIBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site scriptingEPSS 0.2%CVE-2026-6913MEDIUMShortcodely <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_area' Shortcode AttributeEPSS 0.2%CVE-2026-109975MEDIUMCozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block AttributeEPSS 0.2%CVE-2026-119468HIGHWordPress Noptin plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-41355MEDIUMReflected Cross-Site Scripting on Anon Proxy ServerEPSS 0.2%CVE-2026-33402LOWSAK-52311: Sakai site-manage group titles can contain XSS contentEPSS 0.2%CVE-2023-53736MEDIUMKentico Xperience <= 13.0.120 Administration Interface Reflected XSSEPSS 0.2%CVE-2026-66570HIGHWordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-102459MEDIUMDigiWin｜EasyFlow .NET - Reflected Cross-site ScriptingEPSS 0.2%