Weaknesses of type CWE-79

30,630 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-27068HIGHWordPress Website LLMs.txt plugin <= 8.2.6 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2019-25368MEDIUMOPNsense 19.1 Reflected XSS via diag_backup.phpEPSS 0.2%CVE-2026-27070HIGHWordPress Everest Forms Pro plugin <= 1.9.10 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-17739MEDIUMInsufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a EPSS 0.1%CVE-2026-33404LOWPi-hole has a Stored XSS / HTML injection in the Network page/DashboardEPSS 0.1%CVE-2026-84463MEDIUMZammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attributeEPSS 0.1%CVE-2026-107308LOWCountry - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211EPSS 0.1%CVE-2026-33276HIGHXSS in Unified Search via Unescaped Host/Service NamesEPSS 0.1%CVE-2026-59188MEDIUMPart-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment ViewerEPSS 0.1%CVE-2026-115554MEDIUMTivoli Netcool/OMNIbus Web GUI is vulnerable to stored cross-site scriptingEPSS 0.1%CVE-2026-8139LOWConcrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvNameEPSS 0.1%CVE-2026-45560MEDIUMRoxy-WI: Stored XSS in log viewer (wrap_line/highlight_word produce unescaped HTML)EPSS 0.1%CVE-2026-101111MEDIUMJoomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6EPSS 0.1%CVE-2026-48905MEDIUMJoomla! Framework - [20260520] - Inadequate content filtering within the cleanAttributes filter code.EPSS 0.1%CVE-2026-12425MEDIUMReflected / DOM cross-site scripting (XSS) in PowerSchool ERP / Employee Access Center 23.10EPSS 0.1%CVE-2026-17189HIGHSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.1%CVE-2026-35212MEDIUMOpenCTI has XSS in the rendering of email-message observable body dataEPSS 0.1%CVE-2026-38669MEDIUMwCMS v.1.4 is vulnerable to Cross Site Scripting (XSS) when creating a new blog.EPSS 0.1%CVE-2026-49294MEDIUMValhalla has reflected XSS via unsanitized JSONP callback parameterEPSS 0.1%CVE-2026-101109MEDIUMJoomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8EPSS 0.1%