Weaknesses of type CWE-79

30,587 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-25557MEDIUMEvoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameterEPSS 0.2%CVE-2026-63355MEDIUMAffected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on theEPSS 0.2%CVE-2026-4920MEDIUMNext Date <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode AttributeEPSS 0.2%CVE-2026-24979HIGHWordPress Jobica Core plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2021-47951MEDIUMWordPress Picture Gallery 1.4.2 Stored XSS via Edit Content URLEPSS 0.2%CVE-2026-36763MEDIUMA stored cross-site scripting (XSS) vulnerability in the /api/blade-desk/notice/submit endpoint of SpringBlade v4.8.0 allows attackers to exEPSS 0.2%CVE-2024-10031MEDIUMIn Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the unEPSS 0.2%CVE-2026-1711MEDIUMPega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role.EPSS 0.2%CVE-2024-7860MEDIUMSimple Headline Rotator <= 1.0 - Stored XSS via CSRFEPSS 0.2%CVE-2022-50960MEDIUMWordPress International Sms Contact Form 7 Integration 1.2 XSSEPSS 0.2%CVE-2026-63351MEDIUMAffected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before EPSS 0.2%CVE-2026-25351HIGHWordPress MyMedi theme < 1.7.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-23973HIGHWordPress Golo theme < 1.7.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-103846HIGHDimension | Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting) (CWE-79)EPSS 0.2%CVE-2021-47950MEDIUMAdvanced Guestbook 2.4.4 Persistent XSS via SmiliesEPSS 0.2%CVE-2024-7822MEDIUMQuick Code <= 1.0 - Stored XSS via CSRFEPSS 0.2%CVE-2026-4859MEDIUMSP Blog Designer <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'design' AttributeEPSS 0.2%CVE-2026-6237MEDIUMQuick Table <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode AttributeEPSS 0.2%CVE-2026-6256MEDIUMCredits Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode AttributeEPSS 0.2%CVE-2026-3877HIGHReflected Cross-Site Scripting in Dashboard SearchEPSS 0.2%