Weaknesses of type CWE-79

30,585 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-4730MEDIUMCharts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'chartid' Shortcode AttributeEPSS 0.2%CVE-2025-29231MEDIUMA stored cross-site scripting (XSS) vulnerability in the page_save component of Linksys E5600 V1.1.0.26 allows attackers to execute arbitrarEPSS 0.2%CVE-2025-65120MEDIUMReflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, EPSS 0.2%CVE-2026-97344MEDIUMWp Social Login and Register Social Counter <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta WriteEPSS 0.2%CVE-2026-2827MEDIUMOpen User Map PRO <= 1.4.31 - Unauthenticated Stored Cross-Site Scripting via 'oum_location_notification'EPSS 0.2%CVE-2025-11682HIGHStored Cross-Site Scripting in Perx Customer Engagement & Loyalty PlatformEPSS 0.2%CVE-2026-100238MEDIUMFlow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSSEPSS 0.2%CVE-2026-8883MEDIUMGlobal Body Mass Index Calculator <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.2%CVE-2026-30139MEDIUMA reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core before version 6.4.6 allows attaEPSS 0.2%CVE-2026-104726MEDIUMName Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode AttributeEPSS 0.2%CVE-2025-55056MEDIUMMultiple CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')EPSS 0.2%CVE-2026-116582MEDIUMSeroval: Script injection through RegExp sources in serialized outputEPSS 0.2%CVE-2025-68867MEDIUMWordPress Effect Maker plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-97470MEDIUMTourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer RoleEPSS 0.2%CVE-2024-58319MEDIUMKentico Xperience <= 13.0.160 Pages Dashboard Widget Reflected XSSEPSS 0.2%CVE-2025-63032MEDIUMWordPress Consulting theme <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-67075MEDIUMHCL Digital Experience is affected by improper input sanitationEPSS 0.2%CVE-2025-57462MEDIUMStored cross-site scripting (xss) in machsol machpanel 8.0.32 allows attackers to execute arbitrary web scripts or HTML via a crafted PDF fiEPSS 0.2%CVE-2025-49358MEDIUMWordPress Content Fetcher plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-109344MEDIUMDOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize HooksEPSS 0.2%