Weaknesses of type CWE-79

30,596 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-2973MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 0.2%CVE-2026-117539MEDIUMdarylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference BypassEPSS 0.2%CVE-2025-25818MEDIUMA cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a craEPSS 0.2%CVE-2025-62068MEDIUMWordPress e2pdf plugin <= 1.28.09 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-62042MEDIUMWordPress Event post plugin <= 5.10.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-40891LOWHTML injection in in Time Machine functionality in Guardian/CMC before 25.5.0EPSS 0.2%CVE-2026-32712MEDIUMOpen Source Point of Sale has Stored XSS in Customer Name (Sales)EPSS 0.2%CVE-2026-27421MEDIUMWordPress Royal Elementor Addons plugin < 1.7.1053 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-31353MEDIUMAn authenticated stored cross-site scripting (XSS) vulnerability in the Category module of Feehi CMS v2.1.1 allows attackers to execute arbiEPSS 0.2%CVE-2026-10058MEDIUMITP Technology｜ITS Intelligent SCADA System - Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-27258MEDIUMAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)EPSS 0.2%CVE-2026-120491MEDIUMWing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity PageEPSS 0.2%CVE-2026-42192MEDIUMPlunk: Stored XSS in campaign viewEPSS 0.2%CVE-2026-31350MEDIUMAn authenticated stored cross-site scripting (XSS) vulnerability in Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTEPSS 0.2%CVE-2025-36396MEDIUMSecurity vulnerabilities have been found in IBM Application GatewayEPSS 0.2%CVE-2025-62058MEDIUMWordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-2569MEDIUMDear Flipbook <= 2.4.20 - Authenticated (Auhtor+) Stored Cross-Site Scripting via PDF Page LabelsEPSS 0.2%CVE-2026-90443MEDIUMCross-site Scripting in MalcolmEPSS 0.2%CVE-2025-62063MEDIUMWordPress WP Travel Gutenberg Blocks plugin <= 3.9.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-2486MEDIUMMaster Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ma_el_bh_table_btn_text'EPSS 0.2%