Weaknesses of type CWE-79

30,587 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-107682MEDIUMAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)EPSS 0.2%CVE-2026-78087MEDIUMVK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' FeatureEPSS 0.2%CVE-2026-41466MEDIUMProjeQtor < 12.4.4 Stored XSS via checkValidHtmlText()EPSS 0.2%CVE-2026-33683MEDIUMAVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About FieldEPSS 0.2%CVE-2026-119165MEDIUMWPBakery Page Builder <= 9.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display NameEPSS 0.2%CVE-2026-42857MEDIUMOpen edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML SanitizationEPSS 0.2%CVE-2023-54351MEDIUMWordPress Sonaar Music Plugin 4.7 Stored XSS via CommentsEPSS 0.2%CVE-2026-1434MEDIUMReflected XSS in Omega-PSIREPSS 0.2%CVE-2026-109701HIGHWordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-114555LOWData field - Moderately critical - Cross site scripting - SA-CONTRIB-2026-250EPSS 0.2%CVE-2026-111096MEDIUMIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possibleEPSS 0.2%CVE-2026-27756MEDIUMSODOLA SL902-SWTGW124AS <= 200.1.20 Reflected XSS in Management InterfaceEPSS 0.2%CVE-2025-61994MEDIUMCross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbiEPSS 0.2%CVE-2025-61931MEDIUMPleasanter contains a stored cross-site scripting vulnerability in Body, Description and Comments, which allows an attacker to execute an arEPSS 0.2%CVE-2026-64944MEDIUMApache Answer: Stored XSS via unsanitized HTML in imported question contentEPSS 0.2%CVE-2026-94175HIGHWordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-20233MEDIUMCisco Webex Meetings Cross-Site Scripting VulnerabilityEPSS 0.2%CVE-2025-62779LOWFrappe Learning users were able to add HTML through input fields in the Job FormEPSS 0.2%CVE-2026-11744LOWPaperCut Hive Embedded App for Ricoh: Javascript injectionEPSS 0.2%CVE-2026-55876LOWHelium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable ScriptsEPSS 0.2%