Weaknesses of type CWE-79

30,537 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-112844HIGHWordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-68643MEDIUMAxigen Mail Server before 10.5.57 allows stored Cross-Site Scripting (XSS) in the handling of the timeFormat account preference parameter. AEPSS 0.2%CVE-2025-15479MEDIUMNGSurvey Enterprise 3.6.4 incorrect authorization exposes other users’ API keys and personal dataEPSS 0.2%CVE-2025-12475MEDIUMBlocksy Companion <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2023-54362MEDIUMJoomla VirtueMart Shopping-Cart 4.0.12 Reflected XSS via keywordEPSS 0.2%CVE-2026-24620MEDIUMWordPress Landing Page Builder plugin <= 1.5.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-8082MEDIUMVuetify XSS via unsanitized 'titleDateFormat' in 'VDatePicker'EPSS 0.2%CVE-2026-91119MEDIUMDiscourse: Encode action_code_who in mention URLsEPSS 0.2%CVE-2026-2987MEDIUMSimple Ajax Chat <= 20260217 - Unauthenticated Stored Cross-Site Scripting via 'c'EPSS 0.2%CVE-2025-62119MEDIUMWordPress Add Featured Image Custom Link plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-120515MEDIUMSEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_affiliate_tracking' and 'seopress_google_analytics_download_tracking' ParametersEPSS 0.2%CVE-2025-66561HIGHSysReptor Vulnerable to an Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.2%CVE-2025-12956HIGHReflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025xEPSS 0.2%CVE-2026-107710MEDIUMHustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content TitleEPSS 0.2%CVE-2026-91120MEDIUMDiscourse: Stored HTML injection in video notification emailsEPSS 0.2%CVE-2026-100521MEDIUMCotonti through 1.0.0 Reflected XSS via search highlight parameterEPSS 0.2%CVE-2026-21663MEDIUMHackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of Revive Adserver. AnEPSS 0.2%CVE-2026-112869HIGHWordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2023-53738MEDIUMKentico Xperience <= 13.0.109 Page Preview Reflected XSSEPSS 0.2%CVE-2026-102459MEDIUMDigiWin｜EasyFlow .NET - Reflected Cross-site ScriptingEPSS 0.2%