Weaknesses of type CWE-79

30,539 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-94078HIGHWordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-100108MEDIUMSocial Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network SettingEPSS 0.2%CVE-2026-79816MEDIUMUnauthenticated DOM-Based Cross-Site Scripting (XSS) Vulnerability in the ClearPass Policy Manager Client InterfaceEPSS 0.2%CVE-2026-93747MEDIUMwpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile FieldEPSS 0.2%CVE-2026-9019MEDIUMEasy Image Collage <= 1.13.6 - Authenticated (Author+) Stored Cross-Site Scripting via 'grid[properties][borderColor]' and 'grid[images][N][attachment_url]' ParametersEPSS 0.2%CVE-2026-100311MEDIUMmathurvishal CloudClassroom-PHP-Project Faculty Video Management managevideos2.php cross site scriptingEPSS 0.2%CVE-2026-41318MEDIUMAnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable componentEPSS 0.2%CVE-2026-107748MEDIUMUser Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' ParameterEPSS 0.2%CVE-2026-102401MEDIUMDownload Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode AttributeEPSS 0.2%CVE-2025-12513MEDIUMA user with elevated privileges can inject XSS in the Hosts configuration parameters pageEPSS 0.2%CVE-2024-4867MEDIUMCross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information RetrievalEPSS 0.2%CVE-2025-60936MEDIUMEmoncms 11.7.3 is vulnerable to Cross Site in the input handling mechanism. This vulnerability allows authenticated attackers with API accesEPSS 0.2%CVE-2025-54890MEDIUMA user with elevated privileges can inject XSS in the Hostgroups configuration pageEPSS 0.2%CVE-2026-6551MEDIUMTimeline Blocks for Gutenberg <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block AttributeEPSS 0.2%CVE-2026-16776MEDIUMMP3 Audio Player <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-33403MEDIUMPi-hole has a Reflected XSS / HTML injection in taillog.jsEPSS 0.2%CVE-2026-6648MEDIUMQibo CMS Internal Message cross site scriptingEPSS 0.2%CVE-2026-93770HIGHWordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-51225MEDIUMA stored cross-site scripting (XSS) vulnerability in the component /admin/add-brand.php of Phpgurukul Vehicle Record Management System v1.0 EPSS 0.2%CVE-2026-96766MEDIUMGeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' ParameterEPSS 0.2%