Weaknesses of type CWE-79

30,633 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2026-8353LOWConcrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in atomik themeEPSS 0.1%CVE-2026-12380MEDIUMReflected XSS in Akıllı Ticaret's E-Commerce PackEPSS 0.1%CVE-2026-42652HIGHWordPress User Registration plugin <= 5.1.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-87752MEDIUMHTML Injection in Rolantis Information Technologies' AgentisEPSS 0.1%CVE-2023-42345MEDIUMA Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp.EPSS 0.1%CVE-2026-48903MEDIUMJoomla! Framework - [20260519] - Inadequate content filtering within the checkAttribute filter code.EPSS 0.1%CVE-2026-97279MEDIUMWordPress Polylang plugin <= 3.8.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2026-1578MEDIUMHP App – Potential Cross-Site ScriptingEPSS 0.1%CVE-2026-100753MEDIUMJoomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9EPSS 0.1%CVE-2026-91907MEDIUMDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site ScEPSS 0.1%CVE-2026-107252MEDIUMMathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195EPSS 0.1%CVE-2026-50592MEDIUMIn Znuny LTS before 6.5.21 and Znuny before 7.3.3, there is reflected XSS in AdminCommunicationLog (aka the communication log administratiEPSS 0.1%CVE-2026-82969MEDIUMStored XSS in BİMSER's eBA PlusEPSS 0.1%CVE-2026-116888MEDIUMSemanticMediaWiki 3.2.0 before 7.3.1 Stored XSS via Special:Browse Group HeadingEPSS 0.1%CVE-2026-28044MEDIUMWordPress WP Rocket plugin <= 3.19.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%CVE-2025-15363MEDIUMGet Use APIs < 2.0.10 - Contributor+ Stored XSSEPSS 0.1%CVE-2025-40842HIGHEricsson Indoor Connect 8855 - Improper Neutralization of Input During Web Page Generation VulnerabilityEPSS 0.1%CVE-2026-2595MEDIUMQuads Ads Manager for Google AdSense <= 2.0.98.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Ad Metadata ParametersEPSS 0.1%CVE-2026-29513MEDIUMHereta ETH-IMC408M Stored XSS via Device LocationEPSS 0.1%CVE-2026-32868MEDIUMOPEXUS eComplaint and eCASE XSS via my informationEPSS 0.1%