Weaknesses of type CWE-79

30,537 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-110290MEDIUMWebberZone Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block AttributeEPSS 0.2%CVE-2026-96870MEDIUMSureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' ParameterEPSS 0.2%CVE-2026-56347MEDIUMAVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item FieldsEPSS 0.2%CVE-2025-57700HIGHStored Cross-site Scripting in DIAEnergieEPSS 0.2%CVE-2025-67263MEDIUMAbacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting (XSS) vulnerability in the Clients module. The applicatiEPSS 0.2%CVE-2026-4512LOWWP reCaptcha by WebDesignBy < 2.0 – Admin+ Stored XSSEPSS 0.2%CVE-2025-25063MEDIUMAn XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG imEPSS 0.2%CVE-2026-4369HIGHStored Cross-Site Scripting (XSS) Vulnerability in Assembly Variant NameEPSS 0.2%CVE-2025-68936MEDIUMONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.EPSS 0.2%CVE-2026-24351MEDIUMStored XSS in PluXml CMSEPSS 0.2%CVE-2026-2838MEDIUMWhole Enquiry Cart for WooCommerce <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'woowhole_success_msg' ParameterEPSS 0.2%CVE-2026-41518HIGHChartbrew has a stored DOM XSS via Chart Tooltip innerHTML (ChartDatasetConfig.legend)EPSS 0.2%CVE-2025-12544MEDIUMStored Cross-Site Scripting in Multiple WSO2 ProductsEPSS 0.2%CVE-2026-40593MEDIUMChurchCRM: Stored XSS in UserEditor.php via Login Name FieldEPSS 0.2%CVE-2026-8613MEDIUMaThemes Addons for Elementor <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Widget SettingEPSS 0.2%CVE-2025-68935MEDIUMONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.EPSS 0.2%CVE-2026-109322MEDIUMGrav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin ViewsEPSS 0.2%CVE-2026-3354MEDIUMWikilookup <= 1.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Popup Width' SettingEPSS 0.2%CVE-2025-6251MEDIUMRoyal Elementor Addons and Templates <= 1.7.1036 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-35460MEDIUMPapra has an HTML Injection in Transactional Emails via Unescaped User Display NameEPSS 0.2%