Weaknesses of type CWE-79

30,601 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-41241HIGHpretalx: Stored cross-site scripting in organiser search typeaheadEPSS 0.2%CVE-2026-32986MEDIUMTextpattern CMS 4.9.0: Second-Order XSS via Atom Feed InjectionEPSS 0.2%CVE-2026-4268MEDIUMWP Go Maps (formerly WP Google Maps) <= 10.0.05 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settingsEPSS 0.2%CVE-2026-2602MEDIUMTwentig <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'featuredImageSizeWidth'EPSS 0.2%CVE-2025-36033MEDIUMIBM Engineering Lifecycle Management - Global Configuration Management is vulnerable to cross-site scriptingEPSS 0.2%CVE-2026-1575MEDIUMSchema Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%CVE-2025-6229MEDIUMSina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Fancy Text Widget` And `Countdown Widget`EPSS 0.2%CVE-2025-66040LOWSpotipy has a XSS vulnerability in OAuth callback serverEPSS 0.2%CVE-2025-63260MEDIUMSyncFusion 30.1.37 is vulnerable to Cross Site Scripting (XSS) via the Document-Editor reply to comment field and Chat-UI Chat message.EPSS 0.2%CVE-2026-27517MEDIUMBinardat 10G08-0800GSM Network Switch XSSEPSS 0.2%CVE-2025-13983MEDIUMTagify - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-121EPSS 0.2%CVE-2026-33553MEDIUMNorthern.tech CFEngine Enterprise 3.24.3 before 3.24.4 and 3.27.0 before 3.27.1 allows XSS.EPSS 0.2%CVE-2026-107862MEDIUMWordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-32119MEDIUMOpenEMR has Stored DOM XSS via SearchHighlight text-node reconstruction on Custom Report pageEPSS 0.2%CVE-2026-97301MEDIUMWordPress Cool Formkit Lite plugin <= 2.7.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-64292MEDIUMWordPress Analytics Germanized for Google Analytics plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-64365MEDIUMWordPress Ohio Extra plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-39112MEDIUMCross Site Scripting vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the visname parameteEPSS 0.2%CVE-2025-62983MEDIUMWordPress Posts By Tag plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-10850MEDIUMPlane 1.3.1 - Stored XSS in intake issue description_htmlEPSS 0.2%