Weaknesses of type CWE-79

30,537 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-102459MEDIUMDigiWin｜EasyFlow .NET - Reflected Cross-site ScriptingEPSS 0.2%CVE-2026-114179HIGHWordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-21642MEDIUMHackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and `channel-acl.php` scripEPSS 0.2%CVE-2026-6367MEDIUMDrupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003EPSS 0.2%CVE-2022-23961MEDIUMIn Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. This vulnerability can be exploited byEPSS 0.2%CVE-2026-115596HIGHWordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-3673MEDIUMFrappe Framework 16.10.0 - Stored DOM XSS in Tag Pill RendererEPSS 0.2%CVE-2026-115612HIGHWordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-67103HIGHHCL BigFix Service Management is affected by multiple security vulnerabilities.EPSS 0.2%CVE-2025-66484MEDIUMMultiple vulnerabilities have been addressed in IBM Aspera SharesEPSS 0.2%CVE-2025-66359HIGHAn issue was discovered in Logpoint before 7.7.0. Insufficient input validation and a lack of output escaping in multiple components leads tEPSS 0.2%CVE-2026-57691MEDIUMWordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.89 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-10931LOWUmami Analytics - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-109EPSS 0.2%CVE-2026-116621MEDIUMUltimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile FieldEPSS 0.2%CVE-2026-2099MEDIUMFlowring｜AgentFlow - Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-42086MEDIUMOpenC3 COSMOS: Self-XSS in the Command SenderEPSS 0.2%CVE-2026-110290MEDIUMWebberZone Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block AttributeEPSS 0.2%CVE-2026-96563MEDIUMMotors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' ParameterEPSS 0.2%CVE-2026-56347MEDIUMAVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item FieldsEPSS 0.2%CVE-2026-3353MEDIUMComment SPAM Wiper <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' SettingEPSS 0.2%