Weaknesses of type CWE-79

30,601 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-104656HIGHCross-site Scripting in Progress Telerik Fiddler EverywhereEPSS 0.2%CVE-2026-109131MEDIUMAnsible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)EPSS 0.2%CVE-2022-50685MEDIUMKentico Xperience <= 13.0.56 File Upload Stored XSSEPSS 0.2%CVE-2026-109597MEDIUMHugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDsEPSS 0.2%CVE-2024-58322MEDIUMKentico Xperience <= 13.0.158 Shipping Options Stored XSSEPSS 0.2%CVE-2025-67734MEDIUMFrappe Authenticated Users can Execute JavaScript through its Job FormEPSS 0.2%CVE-2026-84925MEDIUMAvada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' ParameterEPSS 0.2%CVE-2025-2154MEDIUMStored XSS in EchoCCS's Specto CMEPSS 0.2%CVE-2025-64999HIGHCross-site scripting in HTML logs of Synthetic Monitoring test servicesEPSS 0.2%CVE-2026-94154MEDIUMAurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting via 'url' ParameterEPSS 0.2%CVE-2026-2951MEDIUMGutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutentor Block HTMLEPSS 0.2%CVE-2026-106707MEDIUMXXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog). An authenticated useEPSS 0.2%CVE-2026-39380MEDIUMOpen Source Point of Sale has Stored XSS in Stock Location (Configuration)EPSS 0.2%CVE-2026-12054MEDIUMDownload Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' ParameterEPSS 0.2%CVE-2026-89117MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise PortalEPSS 0.2%CVE-2026-40451MEDIUMDeepL Chrome browser extension versions from v1.22.0 to v.1.23.0 contain a cross-site scripting vulnerability, which allows an attacker to eEPSS 0.2%CVE-2026-124452MEDIUMOpenEMR before 8.3.0 Stored XSS via Eye Exam Document NotesEPSS 0.2%CVE-2026-106706MEDIUMXXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor. JobCodeController.save() stores tEPSS 0.2%CVE-2026-20108MEDIUMA vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to condEPSS 0.2%CVE-2026-6417MEDIUMGLS Shipping for WooCommerce <= 1.4.0 - Reflected Cross-Site Scripting via 'failed_orders'EPSS 0.2%